Skip to content

Commit dd0f9fd

Browse files
author
ID Bot
committed
Script updating gh-pages from 3ffb3a1. [ci skip]
1 parent 70cb7eb commit dd0f9fd

2 files changed

Lines changed: 67 additions & 60 deletions

File tree

proof-explain/draft-davidben-tls-merkle-tree-certs.html

Lines changed: 46 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -2085,73 +2085,76 @@ <h4 id="name-verifying-a-subtree-consist">
20852085
<p id="section-4.3.2-2">Given a Merkle Tree over <code>n</code> elements, a subtree defined by <code>[start, end)</code>, a consistency proof <code>proof</code>, a subtree hash <code>node_hash</code>, and a root hash <code>root_hash</code>:<a href="#section-4.3.2-2" class="pilcrow"></a></p>
20862086
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3">
20872087
<li id="section-4.3.2-3.1">
2088-
<p id="section-4.3.2-3.1.1">Set <code>fn</code> to <code>start</code>, <code>sn</code> to <code>end - 1</code>, and <code>tn</code> to <code>n - 1</code>.<a href="#section-4.3.2-3.1.1" class="pilcrow"></a></p>
2088+
<p id="section-4.3.2-3.1.1">Check that <code>[start, end)</code> is a valid subtree (<a href="#definition-of-a-subtree" class="auto internal xref">Section 4.1</a>), and that <code>end &lt;= n</code>. If either do not hold, fail proof verification. These checks imply <code>0 &lt;= start &lt; end &lt;= end</code>.<a href="#section-4.3.2-3.1.1" class="pilcrow"></a></p>
20892089
</li>
20902090
<li id="section-4.3.2-3.2">
2091-
<p id="section-4.3.2-3.2.1">If <code>sn</code> is <code>tn</code>, then:<a href="#section-4.3.2-3.2.1" class="pilcrow"></a></p>
2092-
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.2.2">
2093-
<li id="section-4.3.2-3.2.2.1">
2094-
<p id="section-4.3.2-3.2.2.1.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally until <code>fn</code> is <code>sn</code>.<a href="#section-4.3.2-3.2.2.1.1" class="pilcrow"></a></p>
2095-
</li>
2096-
</ol>
2091+
<p id="section-4.3.2-3.2.1">Set <code>fn</code> to <code>start</code>, <code>sn</code> to <code>end - 1</code>, and <code>tn</code> to <code>n - 1</code>.<a href="#section-4.3.2-3.2.1" class="pilcrow"></a></p>
20972092
</li>
20982093
<li id="section-4.3.2-3.3">
2099-
<p id="section-4.3.2-3.3.1">Otherwise:<a href="#section-4.3.2-3.3.1" class="pilcrow"></a></p>
2094+
<p id="section-4.3.2-3.3.1">If <code>sn</code> is <code>tn</code>, then:<a href="#section-4.3.2-3.3.1" class="pilcrow"></a></p>
21002095
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.3.2">
21012096
<li id="section-4.3.2-3.3.2.1">
2102-
<p id="section-4.3.2-3.3.2.1.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally until <code>LSB(sn)</code> is not set or <code>fn</code> is <code>sn</code><a href="#section-4.3.2-3.3.2.1.1" class="pilcrow"></a></p>
2097+
<p id="section-4.3.2-3.3.2.1.1">Until <code>fn</code> is <code>sn</code>, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<a href="#section-4.3.2-3.3.2.1.1" class="pilcrow"></a></p>
21032098
</li>
21042099
</ol>
21052100
</li>
21062101
<li id="section-4.3.2-3.4">
2107-
<p id="section-4.3.2-3.4.1">If <code>fn</code> is <code>sn</code>, set <code>fr</code> and <code>sr</code> to <code>node_hash</code>.<a href="#section-4.3.2-3.4.1" class="pilcrow"></a></p>
2108-
</li>
2109-
<li id="section-4.3.2-3.5">
2110-
<p id="section-4.3.2-3.5.1">Otherwise:<a href="#section-4.3.2-3.5.1" class="pilcrow"></a></p>
2111-
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.5.2">
2112-
<li id="section-4.3.2-3.5.2.1">
2113-
<p id="section-4.3.2-3.5.2.1.1">If <code>proof</code> is an empty array, stop and fail verification.<a href="#section-4.3.2-3.5.2.1.1" class="pilcrow"></a></p>
2114-
</li>
2115-
<li id="section-4.3.2-3.5.2.2">
2116-
<p id="section-4.3.2-3.5.2.2.1">Remove the first value of the <code>proof</code> array and set <code>fr</code> and <code>sr</code> to the removed value.<a href="#section-4.3.2-3.5.2.2.1" class="pilcrow"></a></p>
2102+
<p id="section-4.3.2-3.4.1">Otherwise:<a href="#section-4.3.2-3.4.1" class="pilcrow"></a></p>
2103+
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.4.2">
2104+
<li id="section-4.3.2-3.4.2.1">
2105+
<p id="section-4.3.2-3.4.2.1.1">Until <code>LSB(sn)</code> is not set or <code>fn</code> is <code>sn</code>, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<a href="#section-4.3.2-3.4.2.1.1" class="pilcrow"></a></p>
21172106
</li>
21182107
</ol>
2108+
</li>
2109+
<li id="section-4.3.2-3.5">
2110+
<p id="section-4.3.2-3.5.1">If <code>fn</code> is <code>sn</code>, set <code>fr</code> and <code>sr</code> to <code>node_hash</code>.<a href="#section-4.3.2-3.5.1" class="pilcrow"></a></p>
21192111
</li>
21202112
<li id="section-4.3.2-3.6">
2121-
<p id="section-4.3.2-3.6.1">For each value <code>c</code> in the <code>proof</code> array:<a href="#section-4.3.2-3.6.1" class="pilcrow"></a></p>
2113+
<p id="section-4.3.2-3.6.1">Otherwise:<a href="#section-4.3.2-3.6.1" class="pilcrow"></a></p>
21222114
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.6.2">
21232115
<li id="section-4.3.2-3.6.2.1">
2124-
<p id="section-4.3.2-3.6.2.1.1">If <code>tn</code> is <code>0</code>, then stop the iteration and fail the proof verification.<a href="#section-4.3.2-3.6.2.1.1" class="pilcrow"></a></p>
2116+
<p id="section-4.3.2-3.6.2.1.1">If <code>proof</code> is an empty array, stop and fail verification.<a href="#section-4.3.2-3.6.2.1.1" class="pilcrow"></a></p>
21252117
</li>
21262118
<li id="section-4.3.2-3.6.2.2">
2127-
<p id="section-4.3.2-3.6.2.2.1">If <code>LSB(sn)</code> is set, or if <code>sn</code> is equal to <code>tn</code>, then:<a href="#section-4.3.2-3.6.2.2.1" class="pilcrow"></a></p>
2128-
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.6.2.2.2">
2129-
<li id="section-4.3.2-3.6.2.2.2.1">
2130-
<p id="section-4.3.2-3.6.2.2.2.1.1">If <code>fn &lt; sn</code>, set <code>fr</code> to <code>HASH(0x01 || c || fr)</code>.<a href="#section-4.3.2-3.6.2.2.2.1.1" class="pilcrow"></a></p>
2119+
<p id="section-4.3.2-3.6.2.2.1">Remove the first value of the <code>proof</code> array and set <code>fr</code> and <code>sr</code> to the removed value.<a href="#section-4.3.2-3.6.2.2.1" class="pilcrow"></a></p>
21312120
</li>
2132-
<li id="section-4.3.2-3.6.2.2.2.2">
2133-
<p id="section-4.3.2-3.6.2.2.2.2.1">Set <code>sr</code> to <code>HASH(0x01 || c || sr)</code>.<a href="#section-4.3.2-3.6.2.2.2.2.1" class="pilcrow"></a></p>
2121+
</ol>
2122+
</li>
2123+
<li id="section-4.3.2-3.7">
2124+
<p id="section-4.3.2-3.7.1">For each value <code>c</code> in the <code>proof</code> array:<a href="#section-4.3.2-3.7.1" class="pilcrow"></a></p>
2125+
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.7.2">
2126+
<li id="section-4.3.2-3.7.2.1">
2127+
<p id="section-4.3.2-3.7.2.1.1">If <code>tn</code> is <code>0</code>, then stop the iteration and fail the proof verification.<a href="#section-4.3.2-3.7.2.1.1" class="pilcrow"></a></p>
21342128
</li>
2135-
<li id="section-4.3.2-3.6.2.2.2.3">
2136-
<p id="section-4.3.2-3.6.2.2.2.3.1">Until <code>LSB(sn)</code> is set, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<a href="#section-4.3.2-3.6.2.2.2.3.1" class="pilcrow"></a></p>
2129+
<li id="section-4.3.2-3.7.2.2">
2130+
<p id="section-4.3.2-3.7.2.2.1">If <code>LSB(sn)</code> is set, or if <code>sn</code> is equal to <code>tn</code>, then:<a href="#section-4.3.2-3.7.2.2.1" class="pilcrow"></a></p>
2131+
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.7.2.2.2">
2132+
<li id="section-4.3.2-3.7.2.2.2.1">
2133+
<p id="section-4.3.2-3.7.2.2.2.1.1">If <code>fn &lt; sn</code>, set <code>fr</code> to <code>HASH(0x01 || c || fr)</code>.<a href="#section-4.3.2-3.7.2.2.2.1.1" class="pilcrow"></a></p>
2134+
</li>
2135+
<li id="section-4.3.2-3.7.2.2.2.2">
2136+
<p id="section-4.3.2-3.7.2.2.2.2.1">Set <code>sr</code> to <code>HASH(0x01 || c || sr)</code>.<a href="#section-4.3.2-3.7.2.2.2.2.1" class="pilcrow"></a></p>
2137+
</li>
2138+
<li id="section-4.3.2-3.7.2.2.2.3">
2139+
<p id="section-4.3.2-3.7.2.2.2.3.1">Until <code>LSB(sn)</code> is set, right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> equally.<a href="#section-4.3.2-3.7.2.2.2.3.1" class="pilcrow"></a></p>
21372140
</li>
21382141
</ol>
21392142
</li>
2140-
<li id="section-4.3.2-3.6.2.3">
2141-
<p id="section-4.3.2-3.6.2.3.1">Otherwise:<a href="#section-4.3.2-3.6.2.3.1" class="pilcrow"></a></p>
2142-
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.6.2.3.2">
2143-
<li id="section-4.3.2-3.6.2.3.2.1">
2144-
<p id="section-4.3.2-3.6.2.3.2.1.1">Set <code>sr</code> to <code>HASH(0x01 || sr || c)</code>.<a href="#section-4.3.2-3.6.2.3.2.1.1" class="pilcrow"></a></p>
2143+
<li id="section-4.3.2-3.7.2.3">
2144+
<p id="section-4.3.2-3.7.2.3.1">Otherwise:<a href="#section-4.3.2-3.7.2.3.1" class="pilcrow"></a></p>
2145+
<ol start="1" type="1" class="normal type-1" id="section-4.3.2-3.7.2.3.2">
2146+
<li id="section-4.3.2-3.7.2.3.2.1">
2147+
<p id="section-4.3.2-3.7.2.3.2.1.1">Set <code>sr</code> to <code>HASH(0x01 || sr || c)</code>.<a href="#section-4.3.2-3.7.2.3.2.1.1" class="pilcrow"></a></p>
21452148
</li>
21462149
</ol>
21472150
</li>
2148-
<li id="section-4.3.2-3.6.2.4">
2149-
<p id="section-4.3.2-3.6.2.4.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> once more.<a href="#section-4.3.2-3.6.2.4.1" class="pilcrow"></a></p>
2151+
<li id="section-4.3.2-3.7.2.4">
2152+
<p id="section-4.3.2-3.7.2.4.1">Right-shift <code>fn</code>, <code>sn</code>, and <code>tn</code> once more.<a href="#section-4.3.2-3.7.2.4.1" class="pilcrow"></a></p>
21502153
</li>
21512154
</ol>
21522155
</li>
2153-
<li id="section-4.3.2-3.7">
2154-
<p id="section-4.3.2-3.7.1">Compare <code>tn</code> to <code>0</code>, <code>fr</code> to <code>node_hash</code>, and <code>sr</code> to <code>root_hash</code>. If any are not equal, fail the proof verification. If all are equal, accept the proof.<a href="#section-4.3.2-3.7.1" class="pilcrow"></a></p>
2156+
<li id="section-4.3.2-3.8">
2157+
<p id="section-4.3.2-3.8.1">Compare <code>tn</code> to <code>0</code>, <code>fr</code> to <code>node_hash</code>, and <code>sr</code> to <code>root_hash</code>. If any are not equal, fail the proof verification. If all are equal, accept the proof.<a href="#section-4.3.2-3.8.1" class="pilcrow"></a></p>
21552158
</li>
21562159
</ol>
21572160
<p id="section-4.3.2-4"><a href="#consistency-proof-bits" class="auto internal xref">Appendix B.3</a> explains this procedure in more detail.<a href="#section-4.3.2-4" class="pilcrow"></a></p>
@@ -4303,7 +4306,7 @@ <h3 id="name-consistency-proof-verificat">
43034306
</h3>
43044307
<p id="appendix-B.3-1">The procedure in <a href="#verifying-a-subtree-consistency-proof" class="auto internal xref">Section 4.3.2</a> iteratively builds two hashes, <code>fr</code> and <code>sr</code>, which are expected to equal <code>node_hash</code> and <code>root_hash</code>, respectively. Everything hashed into <code>fr</code> is also hashed into <code>sr</code>, so success demonstrates that <code>root_hash</code> contains <code>node_hash</code>.<a href="#appendix-B.3-1" class="pilcrow"></a></p>
43054308
<p id="appendix-B.3-2">A subtree consistency proof for <code>[start, end)</code> with the tree of <code>n</code> elements is a truncated inclusion proof for element <code>end - 1</code>. The proof is truncated until the highest common node between the right edge of <code>[start, end)</code> and the right edge of the tree.<a href="#appendix-B.3-2" class="pilcrow"></a></p>
4306-
<p id="appendix-B.3-3">Steps 2 and 3 skip to this common node. It may be:<a href="#appendix-B.3-3" class="pilcrow"></a></p>
4309+
<p id="appendix-B.3-3">Steps 3 and 4 skip to this common node. It may be:<a href="#appendix-B.3-3" class="pilcrow"></a></p>
43074310
<ul class="normal">
43084311
<li class="normal" id="appendix-B.3-4.1">
43094312
<p id="appendix-B.3-4.1.1">The entire subtree <code>[start, end)</code> if <code>[start, end)</code> is directly contained in the tree. This will occur if <code>end</code> is <code>n</code>, or if <code>[start, end)</code> is full.<a href="#appendix-B.3-4.1.1" class="pilcrow"></a></p>
@@ -4312,10 +4315,10 @@ <h3 id="name-consistency-proof-verificat">
43124315
<p id="appendix-B.3-4.2.1">Otherwise, the highest full subtree along the right edge of <code>[start, end)</code>.<a href="#appendix-B.3-4.2.1" class="pilcrow"></a></p>
43134316
</li>
43144317
</ul>
4315-
<p id="appendix-B.3-5">In the first case, <code>fn</code> will equal <code>sn</code> after truncation. Step 4 will then initialize the hashes to <code>node_hash</code>. The consistency proof does not need to include a separate copy of <code>node_hash</code>.<a href="#appendix-B.3-5" class="pilcrow"></a></p>
4316-
<p id="appendix-B.3-6">In the second case, <code>fn</code> is less than <code>sn</code>. Step 5 will then initialize the hashes to the first value in the consistency proof.<a href="#appendix-B.3-6" class="pilcrow"></a></p>
4317-
<p id="appendix-B.3-7">From there, step 6 incorporates the consistency proof into <code>sr</code> as in inclusion proof evaluation. In parallel, step 6.2.1 incorporates a subset of the hashes into <code>fr</code>, ony of those subtrees are contained within <code>[start, end)</code>. Specifically, it incorporates only those hashes to the left of the path, and stops incorporating when <code>fn</code> and <code>sn</code> have no longer diverged.<a href="#appendix-B.3-7" class="pilcrow"></a></p>
4318-
<p id="appendix-B.3-8">In the case when <code>fn</code> is <code>sn</code> in step 4, the condition in step 6.2.1 is always false, and <code>fr</code> is always equal to <code>node_hash</code> in step 7. In this case, steps 5 through 7 are equivalent to verifying an inclusion proof for the truncated subtree <code>[fn, sn + 1)</code> and truncated tree <code>tn + 1</code>.<a href="#appendix-B.3-8" class="pilcrow"></a></p>
4318+
<p id="appendix-B.3-5">In the first case, <code>fn</code> will equal <code>sn</code> after truncation. Step 5 will then initialize the hashes to <code>node_hash</code>. The consistency proof does not need to include a separate copy of <code>node_hash</code>.<a href="#appendix-B.3-5" class="pilcrow"></a></p>
4319+
<p id="appendix-B.3-6">In the second case, <code>fn</code> is less than <code>sn</code>. Step 6 will then initialize the hashes to the first value in the consistency proof.<a href="#appendix-B.3-6" class="pilcrow"></a></p>
4320+
<p id="appendix-B.3-7">From there, step 6 incorporates the consistency proof into <code>sr</code> as in inclusion proof evaluation. In parallel, step 7.2.1 incorporates a subset of the hashes into <code>fr</code>, ony of those subtrees are contained within <code>[start, end)</code>. Specifically, it incorporates only those hashes to the left of the path, and stops incorporating when <code>fn</code> and <code>sn</code> have no longer diverged.<a href="#appendix-B.3-7" class="pilcrow"></a></p>
4321+
<p id="appendix-B.3-8">In the case when <code>fn</code> is <code>sn</code> in step 5, the condition in step 7.2.1 is always false, and <code>fr</code> is always equal to <code>node_hash</code> in step 8. In this case, steps 6 through 8 are equivalent to verifying an inclusion proof for the truncated subtree <code>[fn, sn + 1)</code> and truncated tree <code>tn + 1</code>.<a href="#appendix-B.3-8" class="pilcrow"></a></p>
43194322
</section>
43204323
</div>
43214324
</section>

proof-explain/draft-davidben-tls-merkle-tree-certs.txt

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -651,27 +651,31 @@ Table of Contents
651651
end), a consistency proof proof, a subtree hash node_hash, and a root
652652
hash root_hash:
653653

654-
1. Set fn to start, sn to end - 1, and tn to n - 1.
654+
1. Check that [start, end) is a valid subtree (Section 4.1), and
655+
that end <= n. If either do not hold, fail proof verification.
656+
These checks imply 0 <= start < end <= end.
657+
658+
2. Set fn to start, sn to end - 1, and tn to n - 1.
655659

656-
2. If sn is tn, then:
660+
3. If sn is tn, then:
657661

658-
1. Right-shift fn, sn, and tn equally until fn is sn.
662+
1. Until fn is sn, right-shift fn, sn, and tn equally.
659663

660-
3. Otherwise:
664+
4. Otherwise:
661665

662-
1. Right-shift fn, sn, and tn equally until LSB(sn) is not set
663-
or fn is sn
666+
1. Until LSB(sn) is not set or fn is sn, right-shift fn, sn, and
667+
tn equally.
664668

665-
4. If fn is sn, set fr and sr to node_hash.
669+
5. If fn is sn, set fr and sr to node_hash.
666670

667-
5. Otherwise:
671+
6. Otherwise:
668672

669673
1. If proof is an empty array, stop and fail verification.
670674

671675
2. Remove the first value of the proof array and set fr and sr
672676
to the removed value.
673677

674-
6. For each value c in the proof array:
678+
7. For each value c in the proof array:
675679

676680
1. If tn is 0, then stop the iteration and fail the proof
677681
verification.
@@ -690,7 +694,7 @@ Table of Contents
690694

691695
4. Right-shift fn, sn, and tn once more.
692696

693-
7. Compare tn to 0, fr to node_hash, and sr to root_hash. If any
697+
8. Compare tn to 0, fr to node_hash, and sr to root_hash. If any
694698
are not equal, fail the proof verification. If all are equal,
695699
accept the proof.
696700

@@ -2826,7 +2830,7 @@ B.3. Consistency Proof Verification
28262830
proof is truncated until the highest common node between the right
28272831
edge of [start, end) and the right edge of the tree.
28282832

2829-
Steps 2 and 3 skip to this common node. It may be:
2833+
Steps 3 and 4 skip to this common node. It may be:
28302834

28312835
* The entire subtree [start, end) if [start, end) is directly
28322836
contained in the tree. This will occur if end is n, or if [start,
@@ -2835,23 +2839,23 @@ B.3. Consistency Proof Verification
28352839
* Otherwise, the highest full subtree along the right edge of
28362840
[start, end).
28372841

2838-
In the first case, fn will equal sn after truncation. Step 4 will
2842+
In the first case, fn will equal sn after truncation. Step 5 will
28392843
then initialize the hashes to node_hash. The consistency proof does
28402844
not need to include a separate copy of node_hash.
28412845

2842-
In the second case, fn is less than sn. Step 5 will then initialize
2846+
In the second case, fn is less than sn. Step 6 will then initialize
28432847
the hashes to the first value in the consistency proof.
28442848

28452849
From there, step 6 incorporates the consistency proof into sr as in
2846-
inclusion proof evaluation. In parallel, step 6.2.1 incorporates a
2850+
inclusion proof evaluation. In parallel, step 7.2.1 incorporates a
28472851
subset of the hashes into fr, ony of those subtrees are contained
28482852
within [start, end). Specifically, it incorporates only those hashes
28492853
to the left of the path, and stops incorporating when fn and sn have
28502854
no longer diverged.
28512855

2852-
In the case when fn is sn in step 4, the condition in step 6.2.1 is
2853-
always false, and fr is always equal to node_hash in step 7. In this
2854-
case, steps 5 through 7 are equivalent to verifying an inclusion
2856+
In the case when fn is sn in step 5, the condition in step 7.2.1 is
2857+
always false, and fr is always equal to node_hash in step 8. In this
2858+
case, steps 6 through 8 are equivalent to verifying an inclusion
28552859
proof for the truncated subtree [fn, sn + 1) and truncated tree tn +
28562860
1.
28572861

0 commit comments

Comments
 (0)