Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=utf-8
From: "Emek Can Dogru" <e.dogru@conarium.dev>
In-Reply-To: 
 <2JUHvi5yKlM6eew-jlJdy5FjrjDV8igRuIm0OIPZkjl9rEgnMbyf6fLx0AOi_F_X2gRpVtTl9Yka_FPh11842XCXOMNQtruqMN5CwSEbNV0=@vaara.io>
Message-Id: <1788694937221219054.1788694937@conarium.dev>
Mime-Version: 1.0
References: 
 <Y6yqZIoHnmxUHakB-MQWgEM5hvK5JZMv4ycu04O1zh4I3hdI276Wm3Qi-XZrFAjz0bR_BvB2zDSKNEumECSFTRtA2UVcd-h8Lp5VKPuvVoU=@b7n0de.com>
 <e41f6328-fc26-4a5f-998a-d121d4e22db9@csoai.org>
 <2JUHvi5yKlM6eew-jlJdy5FjrjDV8igRuIm0OIPZkjl9rEgnMbyf6fLx0AOi_F_X2gRpVtTl9Yka_FPh11842XCXOMNQtruqMN5CwSEbNV0=@vaara.io>
To: <hello@vaara.io>, <nicholas@csoai.org>
Date: Sun,  6 Sep 2026 11:42:17 +0000 (UTC)
Message-ID-Hash: UL5DIMVC7EJDZ7UYTM7QEOAXV3V6ZFJN
CC: last-call@ietf.org, scitt@ietf.org, kontakt@b7n0de.com,
 vernon@sigilcore.com, pki@varwof.com
Precedence: list
Subject: =?utf-8?q?=5BSCITT=5D_Re=3A_Last_Call=3A_=3Cdraft-ietf-scitt-receipts-ccf-pr?=
 =?utf-8?q?ofile-04=2Etxt=3E_=28CCF_Profile_for_COSE_Receipts=29_to_Proposed?=
 =?utf-8?q?_Standard?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/scitt/zaL2ZFwplWiV1tKcSMmbIYet3Vo>

Henri,

Finding 1 reproduces from the text of -04 alone: sizes 2 to 11 exactly
as you corrected them, and over sizes 2 to 1024 only the ten powers of
two decode every leaf.

One measurement bears on the remedy. The (bits, length) pair identifies
a leaf only when the verifier knows n: the one-element path "1" is
index 1 in a tree of 2, index 2 in a tree of 3, index 4 in a tree of 5
and index 8 in a tree of 9. The proof carries neither n nor the index,
and the payload is the root. So the path-length rule needs the tree
size to travel with the proof; carrying the index needs nothing added.

Script, eleven lines, pinned at
https://gist.github.com/dogrucanemek-alt/a48eb01ae668314fbad889ff69e1e84c

Nothing here blocks -04.

Emek Can Dogru

On Sun, Sep 6, 2026 at 2:14 PM Henri Sirkkavaara <hello@vaara.io> wrote:
> All,
>
> A correction to my own review of 4 September first. In finding 1 I listed=
 n =3D 3, 5, 6, 7 and 11 as the sizes where the path bits decode to the wro=
ng index. That enumeration is incomplete: 9 and 10 fail as well. Rechecking=
 2 through 11 against the definitions as written, every non-power-of-two si=
ze has at least one leaf that decodes wrong, and 2, 4 and 8 decode exactly.=
 So the condition is that index recovery holds when the number of transacti=
ons is a power of two, and not otherwise.
>
> Then one ask, and it sits where the thread already is rather than off to =
the side. This week has settled that the document's defect class is unnamed=
 preimages: Nicholas on internal-evidence, Konrad's sentence binding the oc=
tets of the Signed Statement as registered, Anton's as-transmitted register=
ing the same rule.
>
> Finding 4 in my review is that defect one layer further out, and it is th=
e largest instance in the document. Section 2.1 defines MTH over "a list of=
 serialized transactions (as byte strings)" and gives MTH({d[0]}) =3D HASH(=
d[0]). Section 3.2 computes the leaf as HASH(internal-transaction-hash || H=
ASH(internal-evidence) || data-hash). Nothing in the document says that d[i=
] is that concatenation. A builder working from 2.1 and a verifier working =
from 3.2 can produce different roots, and 2.1 is the definition that looks =
authoritative, because it is the one labelled Merkle Tree Hash.
>
> If the group is naming preimages before this document leaves, that is the=
 one to name.
>
> On finding 1, I left the choice of remedy to the authors and will now say=
 which I would take. Make the path length part of the decoding rule, or car=
ry the index in the proof. Attaching the power-of-two condition to the sent=
ence documents the hazard and leaves it in place, and an application whose =
author does not read that sentence still gets a wrong index and no error.
>
> Still non-blocking, and my support for -04 as Proposed Standard stands.