Timeline for What is the reason to separate domains in the internal hash algorithm of a merkle tree hash?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 30, 2017 at 23:56 | comment | added | poncho | @curious: this attack does not work against the RFC; the attacker could compute the value $H(0||h_0||h_1)$, however what he has the authentication path for is $H(1 ||h_0||h_1)$; and so he can't generate an authentication path for the value he has. Yes, the new forged tree won't be the same length; however I believe that the RFC has variable height Merkle trees, hence the attacker submitting a shorting tree isn't an issue. | |
| Jan 30, 2017 at 23:11 | comment | added | curious | If that is the case then the new forged tree won't be of the same length of the original one, so the will be captured in the verification phase | |
| Jan 30, 2017 at 23:00 | comment | added | curious | Do you mean the adversary can plug into a new tree the value $H(h_0||h_1)$ as a leaf node, and claim a valid hash tree? If that is the case what prevents him from computing the value $H(0||h_0||h_1)$ and plug it into the new tree, which is a valid hash? | |
| Jan 30, 2017 at 22:57 | comment | added | curious | It is not clear to me. Why $h_0||h_1$ can be forged and not $0||h_0||h_1$? | |
| Jan 30, 2017 at 22:35 | history | answered | poncho | CC BY-SA 3.0 |