| Merkle (/ Merkle-Patricia) | Verkle | |
|---|---|---|
| Node primitive | Hash (Keccak/SHA-256) of children | Vector commitment (Ethereum: Pedersen + IPA on Bandersnatch; KZG is the alternative) |
| Node width | 2 (classic) / 16 (Ethereum MPT) | 256 — tree is much shallower |
| Proof contains | All sibling hashes per level | Path commitments + one aggregated opening proof — no siblings |
| Proof size (state-scale) | ~3–4 KB per key in Ethereum's MPT (worse with depth) | ~150–200 bytes per key; multiproof amortizes across many keys |
| Verify cost | A few hashes — very cheap | Elliptic-curve ops — heavier CPU, but bandwidth is the bottleneck being solved |
| Post-quantum | Hash-based → holds up | EC-based → not PQ-safe (known trade-off; PQ successors researched) |
| Update cost | Recompute path hashes — cheap | Commitment updates are homomorphic (add a delta) — fine, but more math |
| Where used | Bitcoin block txs · Ethereum state today (MPT) · certificate transparency · airdrops/allowlists | Ethereum roadmap "The Verge" — statelessness; no major mainnet yet |
Stateless clients. Today a validator needs the full state (hundreds of GB) to execute a block. If every block instead carries a witness — proofs for exactly the state it touches — validators could verify with no local state. With MPT proofs that witness is hundreds of MB–GB scale (too big); with Verkle it drops to a few hundred KB–MB — small enough to gossip with the block.
블록에 "그 블록이 만지는 상태의 증명(witness)"을 동봉해 무상태 검증을 가능하게 하는 것이 목적. 머클 증명으론 witness가 너무 커서 불가능하고, 버클로는 블록과 함께 전파 가능한 크기가 됨.