Date: Sun, 06 Sep 2026 12:41:55 +0000
To: Emek Can Dogru <e.dogru@conarium.dev>
From: Henri Sirkkavaara <hello@vaara.io>
Message-ID: 
 <1udIFKkCbk4eZyI53aLizoDWj-1cx38Sfw7mL7fMUrkHCsfypOhjCGOWVFhdqCvxHDNC1oT3CFwQgYgxZnGQbSkIqKGfRHcZa8ZI69revhQ=@vaara.io>
In-Reply-To: <1788694937221219054.1788694937@conarium.dev>
References: 
 <Y6yqZIoHnmxUHakB-MQWgEM5hvK5JZMv4ycu04O1zh4I3hdI276Wm3Qi-XZrFAjz0bR_BvB2zDSKNEumECSFTRtA2UVcd-h8Lp5VKPuvVoU=@b7n0de.com>
 <e41f6328-fc26-4a5f-998a-d121d4e22db9@csoai.org>
 <2JUHvi5yKlM6eew-jlJdy5FjrjDV8igRuIm0OIPZkjl9rEgnMbyf6fLx0AOi_F_X2gRpVtTl9Yka_FPh11842XCXOMNQtruqMN5CwSEbNV0=@vaara.io>
 <1788694937221219054.1788694937@conarium.dev>
Feedback-ID: 189084408:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Message-ID-Hash: ZCPUFSTQ4WCYTX5SKWRXP74FSMHB5TLB
CC: hello@vaara.io, nicholas@csoai.org, last-call@ietf.org, scitt@ietf.org,
 kontakt@b7n0de.com, vernon@sigilcore.com, pki@varwof.com
Precedence: list
Subject: =?utf-8?q?=5BSCITT=5D_Re=3A_Last_Call=3A_=3Cdraft-ietf-scitt-receipts-ccf-pr?=
	=?utf-8?q?ofile-04=2Etxt=3E_=28CCF_Profile_for_COSE_Receipts=29_to_Proposed?=
	=?utf-8?q?_Standard?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/scitt/hIntJzXvOEgePdgXIovIYKQw3oA>

Emek,

Thank you for running it, and for pinning the script.

Your n =3D 2, 3, 5, 9 numbers settle the remedy choice I left to the author=
s. The path "1" of length one lands on index 1, 2, 4 and 8 in trees of 2, 3=
, 5 and 9, each being the right child of the split at the largest power of =
two below n. So the pair addresses a leaf only once the verifier already ho=
lds n, and the proof carries neither n nor the index today.

That makes the two remedies unequal. The path-length rule needs the tree si=
ze shipped with the proof. The index needs nothing added. So I withdraw the=
 first and recommend the second.

Still non-blocking, and my support for -04 as Proposed Standard stands.


On Sunday, September 6th, 2026 at 14:42, Emek Can Dogru <e.dogru@conarium.d=
ev> wrote:

> Henri,
>=20
> Finding 1 reproduces from the text of -04 alone: sizes 2 to 11 exactly
> as you corrected them, and over sizes 2 to 1024 only the ten powers of
> two decode every leaf.
>=20
> One measurement bears on the remedy. The (bits, length) pair identifies
> a leaf only when the verifier knows n: the one-element path "1" is
> index 1 in a tree of 2, index 2 in a tree of 3, index 4 in a tree of 5
> and index 8 in a tree of 9. The proof carries neither n nor the index,
> and the payload is the root. So the path-length rule needs the tree
> size to travel with the proof; carrying the index needs nothing added.
>=20
> Script, eleven lines, pinned at
> https://gist.github.com/dogrucanemek-alt/a48eb01ae668314fbad889ff69e1e84c
>=20
> Nothing here blocks -04.
>=20
> Emek Can Dogru
>=20
> On Sun, Sep 6, 2026 at 2:14 PM Henri Sirkkavaara <hello@vaara.io> wrote:
> > All,
> >
> > A correction to my own review of 4 September first. In finding 1 I list=
ed n =3D 3, 5, 6, 7 and 11 as the sizes where the path bits decode to the w=
rong index. That enumeration is incomplete: 9 and 10 fail as well. Rechecki=
ng 2 through 11 against the definitions as written, every non-power-of-two =
size has at least one leaf that decodes wrong, and 2, 4 and 8 decode exactl=
y. So the condition is that index recovery holds when the number of transac=
tions is a power of two, and not otherwise.
> >
> > Then one ask, and it sits where the thread already is rather than off t=
o the side. This week has settled that the document's defect class is unnam=
ed preimages: Nicholas on internal-evidence, Konrad's sentence binding the =
octets of the Signed Statement as registered, Anton's as-transmitted regist=
ering the same rule.
> >
> > Finding 4 in my review is that defect one layer further out, and it is =
the largest instance in the document. Section 2.1 defines MTH over "a list =
of serialized transactions (as byte strings)" and gives MTH({d[0]}) =3D HAS=
H(d[0]). Section 3.2 computes the leaf as HASH(internal-transaction-hash ||=
 HASH(internal-evidence) || data-hash). Nothing in the document says that d=
[i] is that concatenation. A builder working from 2.1 and a verifier workin=
g from 3.2 can produce different roots, and 2.1 is the definition that look=
s authoritative, because it is the one labelled Merkle Tree Hash.
> >
> > If the group is naming preimages before this document leaves, that is t=
he one to name.
> >
> > On finding 1, I left the choice of remedy to the authors and will now s=
ay which I would take. Make the path length part of the decoding rule, or c=
arry the index in the proof. Attaching the power-of-two condition to the se=
ntence documents the hazard and leaves it in place, and an application whos=
e author does not read that sentence still gets a wrong index and no error.
> >
> > Still non-blocking, and my support for -04 as Proposed Standard stands.
>=20
> --
> SCITT mailing list -- scitt@ietf.org
> To unsubscribe send an email to scitt-leave@ietf.org
>=20

Henri Sirkkavaara
Vaara -=C2=A0Runtime execution layer for AI agents
Built to see over the noise.
vaara.io
Helsinki, Finland