Transparency root compute

transparency-root-compute · version 1.0.0 · Hashing & signatures · free, no key needed

Compute an RFC 9162 Certificate Transparency Merkle tree root and optional audit path.

Use when you need to: compute current certificate transparency tree root · calculate RFC 9162 Merkle Tree Hash · build certificate log audit path.

Decide before calling

Read the versioned contract and the supported scope below. Reuse transparency-root-compute@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use transparency-root-compute@1.0.0 for compute current certificate transparency tree root. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• compute current certificate transparency tree root
• calculate RFC 9162 Merkle Tree Hash
• build certificate log audit path
• derive transparency tree digest
• generate CT membership branch
• hash ordered certificate log leaves

Not supported

• RFC 6962 compatibility behavior
• verify signed tree heads

Behavior

• RFC 9162 sections 2.1 and 2.1.4; leaves are raw lowercase hexadecimal bytes and SHA-256 domain separation is mandatory.
• The empty tree root is SHA-256 of the empty string; trees split at the largest power of two smaller than their size.

Input

• leaves (array of string, required): max items 4096; each max length 131072; each pattern ^([0-9a-f]{2})*$
• proof_index (integer, optional): min 0; max 9007199254740991

Output

• root (string, required): pattern ^[0-9a-f]{64}$
• tree_size (integer, required): min 0
• audit_path (array or null, required)
• standard (constant "RFC 9162", required)
• reference (constant "RFC 9162 sections 2.1 and 2.1.4", required)

Limits

• max leaves: 4096
• max total leaf bytes: 65536

Example

Request input:

{
  "leaves": []
}

Response:

{
  "result": {
    "root": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "tree_size": 0,
    "audit_path": null,
    "standard": "RFC 9162",
    "reference": "RFC 9162 sections 2.1 and 2.1.4"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "transparency-root-compute",
  "version": "1.0.0",
  "input": {
    "leaves": []
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/transparency-root-compute/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"leaves":[]}'

The machine-readable contract is at /v1/tools/transparency-root-compute/versions/1.0.0.

CLI

node cli.mjs run transparency-root-compute 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Merkle root compute: Compute a Merkle tree root (RFC 9162 or Bitcoin) from a leaf list, with an optional audit path.
• Transparency inclusion verify: Strictly verify an RFC 9162 Certificate Transparency inclusion proof.
• Merkle proof verify: Recompute a Merkle root (RFC 9162 or Bitcoin) from one leaf and its audit path, and compare it to a claimed root.
• Transparency consistency verify: Strictly verify an RFC 9162 Certificate Transparency consistency proof.
• Xxh3 64 compute: Compute the bit-exact XXH3 64-bit hash with a uint64 seed or public 192-byte custom secret.
• Git object id compute: Compute the Git object id git itself would give a blob, tree, commit or tag under Git's exact object framing.