The overview of Blake3 states that Blake3 is internally a Merkle tree. Diving a bit deeper into the paper one finds out that Blake3 splits its input in chunks of 1 KiB (1024 B), organizing chunks in a binary tree whose root is used as the Blake3 hash of the input. This makes it fast to compute the Blake3 hash of large inputs taking advantage of an essentially unlimited amount of paralelization, being it from SIMD or actual parallel threads (in fact, the
blake3 crate both takes advantage of SIMD and offers
rayon-based multi-threaded hashing methods).
Despite Blake3 being internally a Merkle tree, however, I cannot seem to find a way in the
blake3 crate to actually produce and verify Merkle proofs.
If I am hashing, say, 1 MiB worth of input with Blake3, it should not impossible to produce a Merkle proof, verifiable against the Blake3 hash of the whole input, for any of the 1024 contiguous chunks of 1024 bytes of which the input is composed. Right?
I am wondering if the lack of this feature comes from it simply being not (yet?) implemented, or because of some security limitation, or?