Skip to content
rcrootcerts.com

Tools

Merkle Proof Lab

Certificate Transparency logs are append-only Merkle trees. That structure is what lets a client verify a certificate was logged without downloading anything close to the whole log.

Primer

What a Merkle tree actually is

A Merkle tree is a hash tree: every leaf is the hash of one record, every parent is the hash of its two children, and the single hash at the top commits to every record beneath it.

01

Hash each record into a leaf

Every log entry is hashed with a 0x00 domain-separation prefix so a leaf can never be confused with an internal node.

leaf = SHA-256(0x00 || entry)

02

Hash pairs upward

Adjacent hashes are concatenated and hashed with a 0x01 prefix. Repeat level by level until one hash remains.

parent = SHA-256(0x01 || left || right)

03

The root commits to everything

Change one byte in one entry and every hash on the path to the root changes, so the signed tree head no longer matches.

root = Merkle Tree Hash (MTH)

Layer 1

Build the tree

Log entries

Change any entry and the root hash changes completely — that is the tamper evidence.

Tree (leaves at the bottom — click a leaf to prove it)

target leaf proof sibling recomputed spine

Merkle tree hash (root)

Layer 2

Certificate Transparency inclusion proof

Proving entry [0] is in a log of 6 entries requires only 0 sibling hashes — not the log.

    Recomputing…

    recomputed · trusted head

    The verifier never sees the other entries. A match proves inclusion; a mismatch proves the log misbehaved.

    Why this matters

    • RFC 9162 specifies binary Merkle trees for efficient CT auditing.
    • Inclusion proofs grow logarithmically: a million-entry log needs about 20 hashes.
    • Consistency proofs show the log only ever appended — it never rewrote history.
    • Browsers require SCTs, so unexpected issuance for your domains is publicly detectable.

    Proof size vs. log size

    1,00010 hashes
    100,00017 hashes
    1,000,00020 hashes
    1,000,000,00030 hashes

    Layer 3

    Merkle Tree Certificates

    Emerging IETF work — not a generally deployed replacement for conventional certificates

    • Certificate information is represented within a logged tree structure.
    • A signed tree head can authenticate a whole batch of certificate entries.
    • Individual credentials present compact proofs rather than full signature chains.
    • The goal is to reduce repeated logging and signature overhead.
    • Larger PQC signatures and very short lifetimes make that efficiency increasingly relevant.