Hacker News Reader

Comment by EnPissant | Hacker News Reader

> If you have a file and the BLAKE3 hash of that file, you can generate a proof that a portion of the file is correct

This seems wrong to me? I would expect you could only verify the entire file.

This is a difference between BLAKE3 and most other hash functions. In the usual arrangement ("Merkle–Damgård"), each block depends on the previous one, so the only way to verify some "slice" of the input is to re-hash the whole thing. But when you arrange the input into a tree shape (a "Merkle tree") instead, suddenly the right half of the tree does not depend on the left half until the very last step at the very top. If you give me the input to that last step, I can verify that it matches the root hash that I know, now I have the hashes ("chaining values") I'd need to verify either the left half or the right half without the other. Then I do our favorite trick in computer science, which is to recursively apply that same procedure all the way down, until I have an efficient "path" to whatever part of the tree I actually care about.

For more on this see Section 6.4 of our paper: https://docs.google.com/viewer?url=https://github.com/BLAKE3...

And the Bao repo: https://github.com/oconnor663/bao

Yeah, I was objecting to this part:

> If you have a file and the BLAKE3 hash of that file

To me that means the final hash. If you have the full tree of hashes that is a different story!

PS. Thanks for making BLAKE3! I use it in several pieces of software.

Reply on news.ycombinator.com