The Merkle Mountain Belt

TL;DR

This paper compares and introduces Merkle structures optimized for blockchain light client protocols, notably the Merkle Mountain Belt, which is succinct, incremental, and optimally additive, improving efficiency in verifying recent data.

Contribution

The paper introduces the Merkle Mountain Belt, the first Merkle structure that is simultaneously succinct, incremental, and optimally additive, enhancing blockchain light client efficiency.

Findings

Merkle Mountain Belt is succinct, incremental, and optimally additive.

The UMMB variant allows asynchronous client interactions.

Unbalanced structure reduces verification costs for recent data.

Abstract

Merkle structures are widely used as commitment schemes: they allow a prover to publish a compact commitment to an ordered list $X$ of items, and then efficiently prove to a verifier that $x_i\in X$ is the $i$-th item in it. We compare different Merkle structures and their corresponding properties as commitment schemes in the context of blockchain applications. Our primary goal is to speed up light client protocols so that, e.g., a user can verify a transaction efficiently from their smartphone. For instance, the Merkle Mountain Range (MMR) yields a succinct scheme: a light client synchronizing for the first time can do so with a complexity sublinear in $|X|$. On the other hand, the Merkle chain, traditionally used to commit to block headers, is not succinct, but it is incremental - a light client resynchronizing frequently can do so with constant complexity - and optimally additive - the structure can be updated in constant time when a new item is appended to list $X$. We introduce new Merkle structures, most notably the Merkle Mountain Belt (MMB), the first to be simultaneously succinct, incremental and optimally additive. A variant called UMMB is also asynchronous: a light client may continue to interact with the network even when out of sync with the public commitment. Our Merkle structures are slightly unbalanced, so that items recently appended to $X$ receive shorter membership proofs than older items. This feature reduces a light client's expected costs, in applications where queries are biased towards recently generated data.