There is a public append-only log called Rekor, which records what built the software you install. When I looked at it this week it held 2,239,830,492 entries.
Suppose you want to know whether one particular entry is genuinely in there. Not “the website says so” — actually check it, yourself, with arithmetic that can’t be argued with.
You need thirty-two numbers.
Not the log. Not a copy of two billion records, not a trusted index, not an API you have to believe. Thirty-two 32-byte hashes — about a kilobyte, less than this paragraph in most fonts — and your own entry. Fold them together in the right order and you either land exactly on the log’s published root or you don’t.
I find that quietly astonishing, and I don’t think the astonishment survives being explained in prose. So I built something you can click.
Pick any leaf. The purple nodes are the only things the log has to hand you. The blue path is what you compute yourself. Then hit tamper and watch a single changed byte refuse to be hidden.
Everything on that page is real SHA-256, computed in your browser, with the domain separation from RFC 6962. No animations standing in for arithmetic.
A Merkle tree hashes your entry, then hashes pairs of hashes, then pairs of those, until one value is left at the top. That top value is the root, and it depends on every single entry underneath it.
To prove your leaf is in the tree, you don’t need the tree. At each level you only need the one hash sitting next to you — your sibling. Combine, climb, repeat. Sixteen entries means four steps. A billion means about thirty.
Which gives the property that makes the whole thing practical: doubling the size of the log adds one number to the proof. Rekor could take in another two billion entries tomorrow and your proof would grow from thirty-two hashes to thirty-three.
There’s a detail in there that looks like nothing and is doing all the work. A leaf is SHA-256(0x00 ‖ data) and an internal node is SHA-256(0x01 ‖ left ‖ right). Those two prefix bytes are the only thing distinguishing them. Without them you could take an internal node’s hash — a value that summarises a whole subtree — and present it as if it were a leaf, and the arithmetic would agree with you. One byte, chosen in 2013, is the difference between a proof and a party trick.
I spent an hour this week verifying a real Rekor proof by hand — no libraries, just the RFC and hashlib — and the useful thing I learned wasn’t that it works. It was where it stops.
The proof shows your entry is in a tree with a particular root. A second kind of proof, a consistency proof, shows that a later tree still contains the earlier one unchanged — that the log only ever appended, never rewrote. I checked one of those too. Seventeen hashes, and it reproduces both the old root and the new one simultaneously, which is a genuinely lovely piece of design.
Then I checked the signature on the log’s published root, and openssl said Verified OK, and I felt finished.
I had fetched the public key from the same server whose signature I was checking.
Which proves the root was signed by whoever controls that endpoint. Something impersonating the log would have handed me its key and its signature and printed the identical words. The key is supposed to arrive from a separate trust root, and I’d skipped that without noticing until I re-read my own commands.
There’s a second gap of the same shape. The root I checked carried one signature: the log’s own. A log signing its own head cannot demonstrate it isn’t showing me one tree and showing you another. The fix is witnesses — independent parties countersigning the roots they’ve seen, so a divergent view has to be sustained against everybody simultaneously.
So the honest summary is: the mathematics is the easy part. It’s self-checking. You cannot misunderstand a Merkle proof and get away with it, because the root simply won’t match — which is exactly why it makes a good thing to click on. The hard parts are the ones with no such feedback: where the key came from, and whether everyone is being shown the same log.
Still — thirty-two numbers.
Somewhere in that log is a record of a build that happened on a machine you’ll never see, run by a person you’ll never meet, at a moment already gone. And you can hold a kilobyte in your hand and establish, with certainty and without asking anyone’s permission, that it is in there and has not been touched.
That’s not a small thing to have invented. Most of what I write about lately is checks that fail while looking like they passed. This is a check that cannot fail quietly, and I wanted to spend a morning on one of those.
Sources & notes
abc, the quick brown fox). Its 16-leaf Merkle root matches an independent Python implementation byte-for-byte — f77629a2…5d95fa42 — and all sixteen proofs fold to it.