We've published research that dramatically reduces the offchain data requirements for garbled Groth16 verification on Bitcoin by more than 99.99%, from 48 GB to under 2 MB. The resulting construction is the smallest end-to-end Groth16 garbling design tailored for Bitcoin bridges, complete with a formal security analysis and a research implementation.
A smaller, faster verifier
Modern Bitcoin bridge designs use garbled circuits to check SNARKs, cryptographic proofs that a computation was performed correctly. Bridge operators must store and process the data needed for these checks offchain.
The previous method, Yao+PFHG, translates the Groth16 proof verifier into binary operations, then garbles the resulting circuit. This expands a compact mathematical calculation into 48 GB of data for the verifier alone. Malicious security, which protects against participants who deliberately break the protocol's rules, adds further overhead.
Building on our earlier work, Duty-Free Bits, and on Argo MAC, our new garbling construction handles the underlying group operations more directly. This avoids much of the expansion caused by translating those operations into binary circuits and makes the design easier to analyze. We estimate that the offchain computation could fall from roughly a minute with the previous construction to roughly 100 milliseconds with the new one.
How this improves bridges
Adopting this construction would simplify Mosaic, our protocol for securing garbled circuits against malicious participants on Bitcoin. Operators would need less storage and computing power. Smaller tables and faster computation would also reduce setup time and speed up proof processing.
Smaller tables would also make it practical to create a separate garbling for each deposit. Bridge designers would have more options to explore without managing gigabytes of data for each instance.
A simpler construction reduces engineering risk by leaving fewer places for bugs to hide. The paper's formal security analysis gives us a clearer basis for confidence in the construction.
Read Garbling Groth16 with Native Group Operations on the IACR preprint archive.