<blockquote>
  <p>combined together to get the penultimate hash which together with the nonce</p>
</blockquote>

<p>That's not correct. The "penultimate hash" is the merkle root. The nonce is not part of the merkle root at all. That is part of the block header and is hashed along with the merkle root and several other things in order to get the block hash.</p>

<blockquote>
  <p>This merkle tree structure is provided so that one can go back retracing to the roots (i.e to the initial transactions) to verify them, right?</p>
</blockquote>

<p>No. It is provided to commit all of the transactions to the block and to allow someone to prove that a particular transaction is in that block.</p>

<blockquote>
  <p>If that be the case, how does the merkle tree allow one to retrace back and verify transactions?</p>
</blockquote>

<p>It doesn't. Given a transaction, you cannot determine whether it is part of the merkle tree without knowing the hashes of other branches in the tree. The goal isn't to determine whether a transaction is in the merkle tree yourself, rather it is to allow for someone else to prove that a transaction is in the merkle tree by having them provide the hashes of all of the other branches in the tree in the path to the root.</p>

<p>In your example of 4 transactions, if you wanted to prove that C is part of the merkle tree, you would provide C, the hash of D, and the hash AB. The verifier would hash C, hash it with the hash of D to get CD, and hash that with AB in order to get the root. Then they would check whether the root that they calculated matches the root in the block header. In this way, a node can prove to a SPV client that a transaction was included in the blockchain.</p>

CC BY-SA 4.0
2019-07-04T18:03:08.500Z
2019-07-04T18:03:08.500Z
Ava Chow
<p>From what I read, say in a block, there are 4 transactions. The hash value of transactions A and B are combined together to get the hash AB. Same goes for transactions C and D to get hash CD. Later AB and CD are combined together to get the penultimate hash which together with the nonce gives the final hash. This merkle tree structure is provided so that one can go back retracing to the roots (i.e to the initial transactions) to verify them, right?</p>

<p>But what I understand is that hash functions are one way, so it shouldn't be possible for one to go back to the input value by reverse hashing the hash. If that be the case, how does the merkle tree allow one to retrace back and verify transactions?</p>

<blockchain><block><hash><merkle-tree>
Doubt regarding hashing function in Merkle trees
Saumya Bhatt
# Doubt regarding hashing function in Merkle trees

(Asked by: username_0 on 2019-07-04)

From what I read, say in a block, there are 4 transactions. The hash value of transactions A and B are combined together to get the hash AB. Same goes for transactions C and D to get hash CD. Later AB and CD are combined together to get the penultimate hash which together with the nonce gives the final hash. This merkle tree structure is provided so that one can go back retracing to the roots (i.e to the initial transactions) to verify them, right?

But what I understand is that hash functions are one way, so it shouldn't be possible for one to go back to the input value by reverse hashing the hash. If that be the case, how does the merkle tree allow one to retrace back and verify transactions?

**Tags:** blockchain, block, hash, merkle-tree


---

## 1 answers

### Answer by username_1 on 2019-07-04. Score: 3 | Accepted answer

> combined together to get the penultimate hash which together with the nonce

That's not correct. The "penultimate hash" is the merkle root. The nonce is not part of the merkle root at all. That is part of the block header and is hashed along with the merkle root and several other things in order to get the block hash.

> This merkle tree structure is provided so that one can go back retracing to the roots (i.e to the initial transactions) to verify them, right?

No. It is provided to commit all of the transactions to the block and to allow someone to prove that a particular transaction is in that block.

> If that be the case, how does the merkle tree allow one to retrace back and verify transactions?

It doesn't. Given a transaction, you cannot determine whether it is part of the merkle tree without knowing the hashes of other branches in the tree. The goal isn't to determine whether a transaction is in the merkle tree yourself, rather it is to allow for someone else to prove that a transaction is in the merkle tree by having them provide the hashes of all of the other branches in the tree in the path to the root.

In your example of 4 transactions, if you wanted to prove that C is part of the merkle tree, you would provide C, the hash of D, and the hash AB. The verifier would hash C, hash it with the hash of D to get CD, and hash that with AB in order to get the root. Then they would check whether the root that they calculated matches the root in the block header. In this way, a node can prove to a SPV client that a transaction was included in the blockchain.


---

