Lion Cipher Lab

Build a Merkle transparency log from scratch (inclusion proofs, consistency proofs, and the split-view attack)

• Cyber / Security Engineer
• Advanced
• ~120 min
• Free · no account required

Why it matters

Every piece of software you install arrives with an implicit promise: that the thing you downloaded is the thing the publisher meant to publish. A signature is how that promise is usually kept, and a signature is genuinely good -- it proves an artifact came from a holder of a particular key. What a signature cannot tell you is whether that key ever signed anything ELSE. If an attacker steals the signing key, or coerces the publisher, or the publisher simply decides to ship one poisoned build to one target, every signature involved is perfectly valid and nobody outside the room ever finds out.…

What you'll learn

• what a transparency log actually is: an append-only log whose append-only-ness is a claim a client can VERIFY rather than trust
• the RFC 6962 Merkle Tree Hash by hand: SHA-256(0x00 || entry) for leaves, SHA-256(0x01 || left || right) for nodes, SHA-256("") for the empty tree
• why the domain-separation prefixes exist: building the second-preimage forgery you get without them, and watching it fail once they are there
• the RFC 6962 split rule (k = the largest power of two STRICTLY less than n) and what a naive n//2 split breaks
• generating and verifying inclusion proofs (audit paths) with the RFC 9162 Section 2.1.3.2 algorithm
• generating and verifying consistency proofs with RFC 6962 SUBPROOF and the RFC 9162 Section 2.1.4.2 algorithm -- the part almost nobody implements
• measuring the payoff: O(log n) proof hashes instead of O(n) entries, with real byte counts
• the history-rewrite attack: why an inclusion-only client is fooled 100% of the time and a consistency-checking client is not
• the split-view / fork attack, why no single client can detect it, and how gossip and witnesses close it
• signed checkpoints (signed tree heads), and the freshness failure mode that no cryptographic proof can catch

Steps in this lab

1. What you are about to build -- and the two labs this is NOT
2. Open a terminal and check Python (zero-assumption setup)
3. Write mlog.py -- the whole log, in one file
4. Prove it is right -- against PUBLISHED vectors, not against itself
5. Write attacks.py -- seven measured demonstrations
6. (A) Why a hash chain is not enough -- measured
7. (B) The named failure mode: drop the domain-separation prefixes and forge a proof
8. (C) Inclusion proofs -- O(log n) hashes instead of O(n) entries
9. (D) The log rewrites history -- and the inclusion-only client never notices
10. (E) The split-view attack -- and why gossip is the only cure
11. (F) Signed checkpoints, and the freshness failure no proof can catch
12. (G) When NOT to use one: a transparency log is public by construction
13. Why this, not that: a signature, a transparency log, or a blockchain
14. How a pro does it differently
15. What to do on Monday: verify a real log's proofs with the official tooling

Open the full interactive lab →