A hash tree (or Merkle tree) is a method of hierarchically hashing data. They allow efficient parallel hashing and updates and the possibility of verifying partial data.
A hash tree (or Merkle tree, named after Ralph Merkle, who patented them in 1979 for use in combination with the Lamport one-time signature scheme) is a method of hierarchically hashing data.
In a typical hash tree implementation, the data to be hashed is first split into a number of segments (if it is not already so structured). Each of these segments are hashed using an ordinary cryptographic hash function, with the resulting hash values forming the lowest level of the tree.
The hash values at the lowest level are then divided into groups, often of fixed size. (For example, in a binary hash tree, each group would consist of two hash values.) These groups are then each hashed, with the resulting hash values forming the second-lowest level of the tree, and so on. This process is repeated to build the tree from the bottom up, until, at the top level of the tree, only a single hash value remains.
The single hash value at the top level can be used to verify the entire dataset. However, if the hash values at intermediate levels of the tree are also transmitted, they can be used to verify parts of the data without requiring knowledge of the rest. Also, if parts of the data are changed, the hash tree can be efficiently updated by only recomputing the parent nodes of the changed segments. These features make hash trees useful for verifying the integrity of filesystems or databases, as well as for detecting errors in data transmitted out of order e.g. over peer-to-peer file transfer networks.
Another benefit of hash trees over conventional hashing is that, since different branches of the hash tree may be computed independently, the hash calculation and verification can be easily parallelized.
Some care is needed when designing practical tree hashing schemes to avoid collision or preimage attacks, particularly relating to the choice of hash functions used at different levels of the tree, as well as the handling of input data whose length in segments is not a power of two (or, more generally, of the number of children per node). For example, in a naïve hash tree implementation, where the same hash function was used for all levels and the hashes of child nodes were simply concatenated to obtain the input for the parent node's hash, an attacker would be able to trivially generate second preimages of the root hash simply by submitting the concatenation of the second-level hashes as a message.
