Q$5$: Merkle tree is one of the most widely used data structure in cryptography and in computer science in general. It is a succinct commitment to a set of values. For example, given a set of values $x_1,x_2,x_3,x_4,$ and each $x_{i}in\{0,1{\}}^n,$ we can use them as leaf values and build a tree, the root will be committed value to the set, i$.$e$.h_{12}=H(x_1,x_2),h_{34}=H(x_3,x_4)$ and $h_{\text{r}\text{o}\text{o}\text{t}}=H(h_{12},h_{34}),$ where $H$:$\{0,1{\}}^{2n}\{0,1{\}}^n$ is a collision resistant function.

Suppose a Chandler stores only $h_{\text{r}\text{o}\text{o}\text{t}}$ and outsource the original values $x_1,x_2,x_3,x_4$ to a friend Joey.

After the above setup, Chandler may query Joey for certain value when needed. For example, Chandler may ask Joey to send back the second value and prove to him it is indeed the original one. Joey sends $x_2,$ and also sends $x_1,h_{34}$ as the proof ${}_2$ of validity for $x_2.$ Chandler simply tries to reconstruct $h_{\text{r}\text{o}\text{o}\text{t}}$ from $x_2,{}_2.$

a$)$ Briefly explain why Joey can't cheat? For example, why Joey can't send back another value $x_2^{\text{'}}$ and still convinces

Chandler

b$)$ Can example still work if we replace $H$ to be one$-$way function? If yes, briefly explain, if not give a counter

Give Example or Attack