Paper 2026/2877
Toward Efficient Post-Quantum Bitcoin Bridges
, ZKM, GOAT NetworkAbstract
BitVM-style protocols verify succinct proofs on Bitcoin by garbling a proof verifier off-chain. What reaches the chain in a dispute is the proof itself: its bits under one-time keys, the scripts that authenticate them and the signatures that bind them to transactions. Existing designs garble elliptic-curve SNARK verifiers, which a quantum adversary breaks. Our goal is a post-quantum alternative: a hash-based STARK verifier, garbled and fed with hash-based one-time keys, with no number-theoretic assumption anywhere in the verifier; its price is a far larger proof, and this paper measures and reduces that on-chain data. We compile the complete verifier for WHIR-based STARK proofs from Ziren into a Boolean circuit using free-XOR gadgets for binary-tower arithmetic and Blake3. Our implementation uses Ziren’s binary-field proof stage and narrow recursion. For the final recursive WHIR-proof verifier, our circuit-cost analysis gives 218.0M non-free gates and 564,552 input bits, corresponding to 3.49 GB of garbled tables. The transactions publishing that input with translated Winternitz keys have a total virtual size of 4.26 million virtual bytes (MvB) for one key set.
Note: Source code and measurement artifacts are available at https://github.com/GOATNetwork/bitcoin-stark-verifier.
Metadata
- Available format(s)
-
PDF
- Category
- Cryptographic protocols
- Publication info
- Preprint.
- Keywords
- post-quantum securitygarbled circuitsSTARKsWHIRzkVMBitcoin bridges
- Contact author(s)
- stephen d @ zkm io
- History
- 2026-11-14: approved
- 2026-11-12: received
- See all versions
- Short URL
- https://ia.cr/2026/2877
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2026/2877,
author = {Stephen Duan and Vanhger Pham and Blake Hou and Ethan Zhu and Jingping Yin},
title = {Toward Efficient Post-Quantum Bitcoin Bridges},
howpublished = {Cryptology {ePrint} Archive, Paper 2026/2877},
year = {2026},
url = {https://eprint.iacr.org/2026/2877}
}
