Attacking Merkle Trees with a second preimage attack
The authors of Keccak / SHA-3 came up with Sakura[0], a hash tree construction that's provably as collision-resistant as the underlying hash function and very flexible.If you're designing a new system using hash trees, you better use Sakura trees or have a good explanation for why not.Edit: I also wrote some demo code[1] for this attack when arguing with one of the IPFS guys about why they really shouldn't use Bittorrent BEP 30-style Merkle Trees.  In order to get security with Bittorrent-style trees, the [length, root] pair really needs to be your cryptographic identifier, and you need to make sure they're always properly handled as a pair.  There are just too many caveats to usage and we have provably secure alternatives.As a former LimeWire developer, it makes me sad that Gnutella's TigerTrees avoided this vulnerability long before bittorrent's BEP 30 was published, and yet Bittorrent got it wrong.  It was a well-known vulnerability, and was covered as part of my interview at LimeWire.[0]https://keccak.team/files/Sakura.pdf
[1]https://github.com/kmag/bad_examples/tree/master/bad_merkle_...