A Verkle histrion is simply a committedness strategy that works akin to a Merkle tree, but has overmuch smaller witnesses. It works by replacing the hashes successful a Merkle histrion with a vector commitment, which makes wider branching factors much efficient.

Thanks to Kevaundray Wedderburn for feedback connected the post.

Overview

For details connected however verkle trees work, see:

The purpose of this station is to explicate the factual layout of the draft verkle histrion EIP. It is aimed astatine lawsuit developers who privation to instrumentality verkle trees and are looking for an instauration earlier delving deeper into the EIP.

Verkle trees present a fig of changes to the histrion structure. The astir important changes are:

  • a power from 20 byte keys to 32 byte keys (not to beryllium confused with 32 byte addresses, which is simply a abstracted change);
  • the merge of the relationship and retention tries; and finally
  • The instauration of the verkle trie itself, which uses vector commitments alternatively of hashes.

As the vector committedness strategy for the verkle tree, we usage Pedersen commitments. Pedersen commitments are based connected elliptic curves. For an instauration to Pedersen commitments and however to usage them arsenic polynomial oregon vector commitments utilizing Inner Product Argumentss, spot here.

The curve we are utilizing is Bandersnatch. This curve was chosen due to the fact that it is performant, and besides due to the fact that it volition let businesslike SNARKs successful BLS12_381 to crushed astir the verkle histrion successful the future. This tin beryllium utile for rollups arsenic good arsenic allowing an upgrade wherever each witnesses tin beryllium compressed into 1 SNARK erstwhile that becomes practical, without needing a further committedness update.

The curve order/scalar tract size of bandersnatch is p = 13108968793781547619861935127046491459309155893440570251786403306729687672801, which is simply a 253 spot prime. As a effect of this, we tin lone safely perpetrate to spot strings of astatine astir 252 bits, different the tract overflows. We chose a branching origin (width) of 256 for the verkle tree, which means each committedness tin perpetrate to up to 256 values of 252 bits each (or to beryllium precise, integers up to p - 1). We constitute this arsenic Commit(v₀, v₁, …, v₂₅₅) to perpetrate to the database v of magnitude 256.

Layout of the verkle tree

One of the plan goals with the verkle histrion EIP is to marque accesses to neighbouring positions (e.g. retention with astir the aforesaid code oregon neighbouring codification chunks) inexpensive to access. In bid to bash this, a cardinal consists of a stem of 31 bytes and a suffix of 1 byte for a full of 32 bytes. The cardinal strategy is designed truthful that “close” retention locations are mapped to the aforesaid stem and a antithetic suffix. For details delight look astatine the EIP draft.

The verkle histrion itself is past composed of 2 types of nodes:

  • Extension nodes, that correspond 256 values with the aforesaid stem but antithetic suffixes
  • Inner nodes, that person up to 256 children, which tin beryllium either different interior nodes oregon hold nodes.

The committedness to an hold node is simply a committedness to a 4 constituent vector; the remaining positions volition beryllium 0. It is:

C₁ and C₂ are 2 further commitments that perpetrate to each the values with stem adjacent to stem. The crushed we request to commitments is that values person 32 bytes, but we tin lone store 252 bits per tract element. A azygous committedness would frankincense not beryllium capable to store 256 values. So alternatively C₁ stores the values for suffix 0 to 127, and C₂ stores 128 to 255, wherever the values are divided successful 2 successful bid to acceptable into the tract size (we’ll travel to that later.)

The hold unneurotic with the commitments C₁ and C₂ are referred to arsenic “extension-and-suffix tree” (EaS for short).

Figure 1 Representation of a locomotion done a verkle histrion for the cardinal 0xfe0002abcd..ff04: the way goes done 3 interior nodes with 256 children each (254, 0, 2), 1 hold node representing abcd..ff and the 2 suffix histrion commitments, including the worth for 04, v₄. Note that stem is really the archetypal 31 bytes of the key, including the way done the interior nodes.

Commitment to the values leafage nodes

Each hold and suffix histrion node incorporate 256 values. Because a worth is 256 bits wide, and we tin lone store 252 bits safely successful 1 tract element, 4 bits would beryllium mislaid if we simply tried truthful store 1 worth successful 1 tract element.

To circumvent this problem, we chose to partition the radical of 256 values into 2 groups of 128 values each. Each 32-byte worth successful a radical is divided into 2 16-byte values. So a worth vᵢ∈ 𝔹₃₂ is turned into v⁽ˡᵒʷᵉʳ⁾ᵢ ∈ 𝔹₁₆ and v⁽ᵘᵖᵖᵉʳ⁾ᵢ∈ 𝔹₁₆ specified that v⁽ˡᵒʷᵉʳ⁾ᵢ ++ v⁽ᵘᵖᵖᵉʳ⁾ᵢ= vᵢ.

A “leaf marker” is added to the v⁽ˡᵒʷᵉʳ⁾ᵢ, to differentiate betwixt a leafage that has ne'er been accessed and a leafage that has been overwritten with 0s. No worth ever gets deleted from a verkle tree. This is needed for upcoming authorities expiry schemes. That marker is acceptable astatine the 129th bit, i.e. v⁽ˡᵒʷᵉʳ ᵐᵒᵈⁱᶠⁱᵉᵈ⁾ᵢ = v⁽ˡᵒʷᵉʳ⁾ᵢ + 2¹²⁸ if vᵢ has been accessed before, and v⁽ˡᵒʷᵉʳ ᵐᵒᵈⁱᶠⁱᵉᵈ⁾ᵢ = 0 if vᵢ has ne'er been accessed.

The 2 commitments C₁ and C₂ are past defined as

Commitment of hold nodes

The committedness to an hold node is composed of an “extension marker”, which is conscionable the fig 1, the 2 subtree commitments C₁ and C₂, and the stem of the cardinal starring to this hold node.

Unlike hold nodes successful the Merkle-Patricia tree, which lone incorporate the conception of the cardinal that bridges the genitor interior node to the kid interior node, the stem covers the full cardinal up to that point. This is due to the fact that verkle trees are designed with stateless proofs successful mind: if a caller cardinal is inserted that “splits” the hold successful two, the older sibling request not beryllium updated, which allows for a smaller proof.

Commitment of Internal nodes

Internal nodes person the simpler calculation method for their commitments: the node is seen arsenic a vector of 256 values, that are the (field practice of the) basal committedness of each of their 256 subtrees. The committedness for an bare subtree is 0. If the subtree is not empty, past the committedness for the interior node is

where the Cᵢ are the children of the interior node, and 0 if a kid is empty.

Insertion into the tree

Figure 2 is an illustration of the process of inserting a caller worth into the tree, which gets absorbing erstwhile the stems collide connected respective archetypal bytes.

Figure 2 Value v₁₉₂ is inserted astatine determination 0000010000...0000 successful a verkle histrion containing lone worth v₁₂₇ astatine determination 0000000000...0000. Because the stems disagree astatine the 3rd byte, 2 interior nodes are added until the differing byte. Then different “extension-and-suffix” histrion is inserted, with a afloat 31-byte stem. The archetypal node is untouched, and C²₀ has the aforesaid worth arsenic C⁰₀ earlier the insertion.

Shallower trees, smaller proofs

The verkle histrion operation makes for shallower trees, which reduces the magnitude of stored data. Its existent power, however, comes from the quality to nutrient smaller proofs, i.e. witnesses. This volition beryllium explained successful the adjacent article.