Ct merkle root compute

ct-merkle-root-compute · version 1.0.0 · Encoding & checksums · free, no key needed

Compute the RFC 6962 v1 domain-separated Merkle Tree Hash of raw leaves.

Use when you need to: compute an RFC 6962 v1 certificate transparency tree root · hash raw CT leaves with RFC 6962 domain separation · calculate a certificate transparency v1 Merkle root.

Decide before calling

Read the versioned contract and the supported scope below. Reuse ct-merkle-root-compute@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use ct-merkle-root-compute@1.0.0 for compute an RFC 6962 v1 certificate transparency tree root. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• compute an RFC 6962 v1 certificate transparency tree root
• hash raw CT leaves with RFC 6962 domain separation
• calculate a certificate transparency v1 Merkle root
• reproduce a CT log tree hash from leaves
• apply CT leaf and node hash prefixes
• check a batch of CT leaves against a root

Not supported

• RFC 9162 tile hashing
• building inclusion or consistency proofs

Behavior

• Raw leaves are lowercase hex bytes. MTH({})=SHA-256(empty), MTH({d})=SHA-256(0x00||d), and larger trees split at the largest power of two smaller than n and hash SHA-256(0x01||left||right), per RFC 6962 section 2.1.
• At most 4096 leaves and 65536 decoded bytes total are accepted.

Input

• leaves (array of string, required): max items 4096; each max length 131072; each pattern ^([0-9a-f]{2})*$

Output

• root (string, required): pattern ^[0-9a-f]{64}$
• leaf_count (integer, required): min 0
• standard (one of "RFC 6962", required)
• reference (one of "RFC 6962 sections 2.1 and 2.1.1", required)

Limits

• max leaves: 4096
• max total leaf bytes: 65536

Example

Request input:

{
  "leaves": []
}

Response:

{
  "result": {
    "root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "leaf_count": 0,
    "standard": "RFC 6962",
    "reference": "RFC 6962 sections 2.1 and 2.1.1"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "ct-merkle-root-compute",
  "version": "1.0.0",
  "input": {
    "leaves": []
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/ct-merkle-root-compute/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"leaves":[]}'

The machine-readable contract is at /v1/tools/ct-merkle-root-compute/versions/1.0.0.

CLI

node cli.mjs run ct-merkle-root-compute 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Ct inclusion proof verify: Strictly verify an RFC 6962 v1 Merkle audit path.
• Ct consistency proof verify: Strictly verify an RFC 6962 v1 append-only consistency proof.
• Pem envelope format: Format a label and lowercase hex bytes as a canonical RFC 7468 PEM envelope.
• Bech32 encode: Encode lowercase HRP and 5-bit data as Bech32 or Bech32m text using that checksum.
• Pem envelope parse: Parse one RFC 7468 textual envelope into its label and lowercase hex bytes.
• Bech32 convert bits: Regroup integers between bit widths using BIP 173 rules, rejecting bad leftover padding.