You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<pid="section-4.3.2-2">Given a Merkle Tree over <code>n</code> elements, a subtree defined by <code>[start, end)</code>, a consistency proof <code>proof</code>, a subtree hash <code>node_hash</code>, and a root hash <code>root_hash</code>:<ahref="#section-4.3.2-2" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.1.1">Set <code>fn</code> to <code>start</code>, <code>sn</code>to <code>end - 1</code>, and <code>tn</code> to <code>n - 1</code>.<ahref="#section-4.3.2-3.1.1" class="pilcrow">¶</a></p>
2088
+
<pid="section-4.3.2-3.1.1">Check that <code>[start, end)</code>is a valid subtree (<ahref="#definition-of-a-subtree" class="auto internal xref">Section 4.1</a>), and that <code>end <= n</code>. If either do not hold, fail proof verification. These checks imply <code>0 <= start < end <= end</code>.<ahref="#section-4.3.2-3.1.1" class="pilcrow">¶</a></p>
2089
2089
</li>
2090
2090
<liid="section-4.3.2-3.2">
2091
-
<pid="section-4.3.2-3.2.1">If <code>sn</code> is <code>tn</code>, then:<ahref="#section-4.3.2-3.2.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.2.2.1.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally until <code>fn</code> is <code>sn</code>.<ahref="#section-4.3.2-3.2.2.1.1" class="pilcrow">¶</a></p>
2095
-
</li>
2096
-
</ol>
2091
+
<pid="section-4.3.2-3.2.1">Set <code>fn</code> to <code>start</code>, <code>sn</code> to <code>end - 1</code>, and <code>tn</code> to <code>n - 1</code>.<ahref="#section-4.3.2-3.2.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.3.2.1.1">Right-shift<code>fn</code>, <code>sn</code>, and<code>tn</code> equally until <code>LSB(sn)</code> is not set or <code>fn</code>is <code>sn</code><ahref="#section-4.3.2-3.3.2.1.1" class="pilcrow">¶</a></p>
2097
+
<pid="section-4.3.2-3.3.2.1.1">Until<code>fn</code> is <code>sn</code>, right-shift<code>fn</code>, <code>sn</code>, and <code>tn</code>equally.<ahref="#section-4.3.2-3.3.2.1.1" class="pilcrow">¶</a></p>
2103
2098
</li>
2104
2099
</ol>
2105
2100
</li>
2106
2101
<liid="section-4.3.2-3.4">
2107
-
<pid="section-4.3.2-3.4.1">If <code>fn</code> is <code>sn</code>, set <code>fr</code> and <code>sr</code> to <code>node_hash</code>.<ahref="#section-4.3.2-3.4.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.5.2.1.1">If <code>proof</code> is an empty array, stop and fail verification.<ahref="#section-4.3.2-3.5.2.1.1" class="pilcrow">¶</a></p>
2114
-
</li>
2115
-
<liid="section-4.3.2-3.5.2.2">
2116
-
<pid="section-4.3.2-3.5.2.2.1">Remove the first value of the <code>proof</code> array and set <code>fr</code> and <code>sr</code> to the removed value.<ahref="#section-4.3.2-3.5.2.2.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.4.2.1.1">Until <code>LSB(sn)</code> is not set or <code>fn</code> is <code>sn</code>, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<ahref="#section-4.3.2-3.4.2.1.1" class="pilcrow">¶</a></p>
2117
2106
</li>
2118
2107
</ol>
2108
+
</li>
2109
+
<liid="section-4.3.2-3.5">
2110
+
<pid="section-4.3.2-3.5.1">If <code>fn</code> is <code>sn</code>, set <code>fr</code> and <code>sr</code> to <code>node_hash</code>.<ahref="#section-4.3.2-3.5.1" class="pilcrow">¶</a></p>
2119
2111
</li>
2120
2112
<liid="section-4.3.2-3.6">
2121
-
<pid="section-4.3.2-3.6.1">For each value <code>c</code> in the <code>proof</code> array:<ahref="#section-4.3.2-3.6.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.6.2.1.1">If <code>tn</code> is <code>0</code>, then stop the iteration and fail the proof verification.<ahref="#section-4.3.2-3.6.2.1.1" class="pilcrow">¶</a></p>
2116
+
<pid="section-4.3.2-3.6.2.1.1">If <code>proof</code> is an empty array, stop and fail verification.<ahref="#section-4.3.2-3.6.2.1.1" class="pilcrow">¶</a></p>
2125
2117
</li>
2126
2118
<liid="section-4.3.2-3.6.2.2">
2127
-
<pid="section-4.3.2-3.6.2.2.1">If <code>LSB(sn)</code> is set, or if <code>sn</code> is equal to <code>tn</code>, then:<ahref="#section-4.3.2-3.6.2.2.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.6.2.2.2.1.1">If <code>fn < sn</code>, set <code>fr</code> to <code>HASH(0x01 || c || fr)</code>.<ahref="#section-4.3.2-3.6.2.2.2.1.1" class="pilcrow">¶</a></p>
2119
+
<pid="section-4.3.2-3.6.2.2.1">Remove the first value of the <code>proof</code> array and set <code>fr</code> and <code>sr</code> to the removed value.<ahref="#section-4.3.2-3.6.2.2.1" class="pilcrow">¶</a></p>
2131
2120
</li>
2132
-
<liid="section-4.3.2-3.6.2.2.2.2">
2133
-
<pid="section-4.3.2-3.6.2.2.2.2.1">Set <code>sr</code> to <code>HASH(0x01 || c || sr)</code>.<ahref="#section-4.3.2-3.6.2.2.2.2.1" class="pilcrow">¶</a></p>
2121
+
</ol>
2122
+
</li>
2123
+
<liid="section-4.3.2-3.7">
2124
+
<pid="section-4.3.2-3.7.1">For each value <code>c</code> in the <code>proof</code> array:<ahref="#section-4.3.2-3.7.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.7.2.1.1">If <code>tn</code> is <code>0</code>, then stop the iteration and fail the proof verification.<ahref="#section-4.3.2-3.7.2.1.1" class="pilcrow">¶</a></p>
2134
2128
</li>
2135
-
<liid="section-4.3.2-3.6.2.2.2.3">
2136
-
<pid="section-4.3.2-3.6.2.2.2.3.1">Until <code>LSB(sn)</code> is set, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<ahref="#section-4.3.2-3.6.2.2.2.3.1" class="pilcrow">¶</a></p>
2129
+
<liid="section-4.3.2-3.7.2.2">
2130
+
<pid="section-4.3.2-3.7.2.2.1">If <code>LSB(sn)</code> is set, or if <code>sn</code> is equal to <code>tn</code>, then:<ahref="#section-4.3.2-3.7.2.2.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.7.2.2.2.1.1">If <code>fn < sn</code>, set <code>fr</code> to <code>HASH(0x01 || c || fr)</code>.<ahref="#section-4.3.2-3.7.2.2.2.1.1" class="pilcrow">¶</a></p>
2134
+
</li>
2135
+
<liid="section-4.3.2-3.7.2.2.2.2">
2136
+
<pid="section-4.3.2-3.7.2.2.2.2.1">Set <code>sr</code> to <code>HASH(0x01 || c || sr)</code>.<ahref="#section-4.3.2-3.7.2.2.2.2.1" class="pilcrow">¶</a></p>
2137
+
</li>
2138
+
<liid="section-4.3.2-3.7.2.2.2.3">
2139
+
<pid="section-4.3.2-3.7.2.2.2.3.1">Until <code>LSB(sn)</code> is set, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<ahref="#section-4.3.2-3.7.2.2.2.3.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.6.2.3.2.1.1">Set <code>sr</code> to <code>HASH(0x01 || sr || c)</code>.<ahref="#section-4.3.2-3.6.2.3.2.1.1" class="pilcrow">¶</a></p>
<pid="section-4.3.2-3.7.2.3.2.1.1">Set <code>sr</code> to <code>HASH(0x01 || sr || c)</code>.<ahref="#section-4.3.2-3.7.2.3.2.1.1" class="pilcrow">¶</a></p>
2145
2148
</li>
2146
2149
</ol>
2147
2150
</li>
2148
-
<liid="section-4.3.2-3.6.2.4">
2149
-
<pid="section-4.3.2-3.6.2.4.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> once more.<ahref="#section-4.3.2-3.6.2.4.1" class="pilcrow">¶</a></p>
2151
+
<liid="section-4.3.2-3.7.2.4">
2152
+
<pid="section-4.3.2-3.7.2.4.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> once more.<ahref="#section-4.3.2-3.7.2.4.1" class="pilcrow">¶</a></p>
2150
2153
</li>
2151
2154
</ol>
2152
2155
</li>
2153
-
<liid="section-4.3.2-3.7">
2154
-
<pid="section-4.3.2-3.7.1">Compare <code>tn</code> to <code>0</code>, <code>fr</code> to <code>node_hash</code>, and <code>sr</code> to <code>root_hash</code>. If any are not equal, fail the proof verification. If all are equal, accept the proof.<ahref="#section-4.3.2-3.7.1" class="pilcrow">¶</a></p>
2156
+
<liid="section-4.3.2-3.8">
2157
+
<pid="section-4.3.2-3.8.1">Compare <code>tn</code> to <code>0</code>, <code>fr</code> to <code>node_hash</code>, and <code>sr</code> to <code>root_hash</code>. If any are not equal, fail the proof verification. If all are equal, accept the proof.<ahref="#section-4.3.2-3.8.1" class="pilcrow">¶</a></p>
2155
2158
</li>
2156
2159
</ol>
2157
2160
<pid="section-4.3.2-4"><ahref="#consistency-proof-bits" class="auto internal xref">Appendix B.3</a> explains this procedure in more detail.<ahref="#section-4.3.2-4" class="pilcrow">¶</a></p>
<pid="appendix-B.3-1">The procedure in <ahref="#verifying-a-subtree-consistency-proof" class="auto internal xref">Section 4.3.2</a> iteratively builds two hashes, <code>fr</code> and <code>sr</code>, which are expected to equal <code>node_hash</code> and <code>root_hash</code>, respectively. Everything hashed into <code>fr</code> is also hashed into <code>sr</code>, so success demonstrates that <code>root_hash</code> contains <code>node_hash</code>.<ahref="#appendix-B.3-1" class="pilcrow">¶</a></p>
4305
4308
<pid="appendix-B.3-2">A subtree consistency proof for <code>[start, end)</code> with the tree of <code>n</code> elements is a truncated inclusion proof for element <code>end - 1</code>. The proof is truncated until the highest common node between the right edge of <code>[start, end)</code> and the right edge of the tree.<ahref="#appendix-B.3-2" class="pilcrow">¶</a></p>
4306
-
<pid="appendix-B.3-3">Steps 2 and 3 skip to this common node. It may be:<ahref="#appendix-B.3-3" class="pilcrow">¶</a></p>
4309
+
<pid="appendix-B.3-3">Steps 3 and 4 skip to this common node. It may be:<ahref="#appendix-B.3-3" class="pilcrow">¶</a></p>
4307
4310
<ulclass="normal">
4308
4311
<liclass="normal" id="appendix-B.3-4.1">
4309
4312
<pid="appendix-B.3-4.1.1">The entire subtree <code>[start, end)</code> if <code>[start, end)</code> is directly contained in the tree. This will occur if <code>end</code> is <code>n</code>, or if <code>[start, end)</code> is full.<ahref="#appendix-B.3-4.1.1" class="pilcrow">¶</a></p>
<pid="appendix-B.3-4.2.1">Otherwise, the highest full subtree along the right edge of <code>[start, end)</code>.<ahref="#appendix-B.3-4.2.1" class="pilcrow">¶</a></p>
4313
4316
</li>
4314
4317
</ul>
4315
-
<pid="appendix-B.3-5">In the first case, <code>fn</code> will equal <code>sn</code> after truncation. Step 4 will then initialize the hashes to <code>node_hash</code>. The consistency proof does not need to include a separate copy of <code>node_hash</code>.<ahref="#appendix-B.3-5" class="pilcrow">¶</a></p>
4316
-
<pid="appendix-B.3-6">In the second case, <code>fn</code> is less than <code>sn</code>. Step 5 will then initialize the hashes to the first value in the consistency proof.<ahref="#appendix-B.3-6" class="pilcrow">¶</a></p>
4317
-
<pid="appendix-B.3-7">From there, step 6 incorporates the consistency proof into <code>sr</code> as in inclusion proof evaluation. In parallel, step 6.2.1 incorporates a subset of the hashes into <code>fr</code>, ony of those subtrees are contained within <code>[start, end)</code>. Specifically, it incorporates only those hashes to the left of the path, and stops incorporating when <code>fn</code> and <code>sn</code> have no longer diverged.<ahref="#appendix-B.3-7" class="pilcrow">¶</a></p>
4318
-
<pid="appendix-B.3-8">In the case when <code>fn</code> is <code>sn</code> in step 4, the condition in step 6.2.1 is always false, and <code>fr</code> is always equal to <code>node_hash</code> in step 7. In this case, steps 5 through 7 are equivalent to verifying an inclusion proof for the truncated subtree <code>[fn, sn + 1)</code> and truncated tree <code>tn + 1</code>.<ahref="#appendix-B.3-8" class="pilcrow">¶</a></p>
4318
+
<pid="appendix-B.3-5">In the first case, <code>fn</code> will equal <code>sn</code> after truncation. Step 5 will then initialize the hashes to <code>node_hash</code>. The consistency proof does not need to include a separate copy of <code>node_hash</code>.<ahref="#appendix-B.3-5" class="pilcrow">¶</a></p>
4319
+
<pid="appendix-B.3-6">In the second case, <code>fn</code> is less than <code>sn</code>. Step 6 will then initialize the hashes to the first value in the consistency proof.<ahref="#appendix-B.3-6" class="pilcrow">¶</a></p>
4320
+
<pid="appendix-B.3-7">From there, step 6 incorporates the consistency proof into <code>sr</code> as in inclusion proof evaluation. In parallel, step 7.2.1 incorporates a subset of the hashes into <code>fr</code>, ony of those subtrees are contained within <code>[start, end)</code>. Specifically, it incorporates only those hashes to the left of the path, and stops incorporating when <code>fn</code> and <code>sn</code> have no longer diverged.<ahref="#appendix-B.3-7" class="pilcrow">¶</a></p>
4321
+
<pid="appendix-B.3-8">In the case when <code>fn</code> is <code>sn</code> in step 5, the condition in step 7.2.1 is always false, and <code>fr</code> is always equal to <code>node_hash</code> in step 8. In this case, steps 6 through 8 are equivalent to verifying an inclusion proof for the truncated subtree <code>[fn, sn + 1)</code> and truncated tree <code>tn + 1</code>.<ahref="#appendix-B.3-8" class="pilcrow">¶</a></p>
0 commit comments