You're using a classical merkle tree which has only two tags, one for leaves, and one for inner nodes. This doesn't have any practical weaknesses, but lowers second pre-image resistance from 2^256 to (2^256)/n. For realistic input sizes that's still above 2^200, so it doesn't really matter. I believe a construction that uses unique tags for each node (for example using a (depth, node-index) pair is a bit stronger, since it avoids this issue.
_______________________________________________ cryptography mailing list [email protected] http://lists.randombit.net/mailman/listinfo/cryptography
