A secure digest cannot fix an ambiguous original encoding.
LET’S PICTURE IT
Two different filled forms should not collapse into one identical byte string.
SEE IT FOR YOURSELF
Build a root and follow one membership proofStep 1 / 4
This example hashes UTF-8 A, B, C and D. The displayed hashes are abbreviated, and the tree uses the playground’s sorted-pair convention.
This example hashes UTF-8 A, B, C and D. The displayed hashes are abbreviated, and the tree uses the playground’s sorted-pair convention.Each pair of raw child hashes is sorted, concatenated and hashed. The resulting parent fingerprints commit to their children.Hash the two parents under the same rule to obtain one root commitment. Changing a leaf changes the hashes on its path.The highlighted siblings are B and hash(C,D). Starting with A, the verifier recomputes its path and compares the final result with a trusted root.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
Define the ambiguity
Packed concatenation of a and bc gives the same bytes as ab and c when both fields are variable strings and no boundaries are included.
Hashing preserves identical input
If two logical records already encode to identical bytes, their digests match without breaking the hash function. This is an encoding design problem.
Use a structured convention
Typed standard encoding, explicit lengths or another reviewed unambiguous format can preserve boundaries. The leaf builder and verifier must use the same convention.
Separate leaves from inner nodes
A scheme can also need domain separation between original leaf material and internal node concatenation. Review both record encoding and tree-node encoding.