I am studying Merkle Tree Construction for digital signature. I don't quite understand why we need collision resistant hash function for Merkle tree construction.
There are few papers like XMSS that try to lower the requirement from collision resistant hash function to second-preimage hash function by introducing bit mask. However, does it implies longer public key, more works need to be done on verifier side?
is there a known attack on traditional Merkle tree that only uses second preimage resistant hash function?