Start with exact bytes SHA-256 parses big-endian 32-bit words in 64-byte blocks. abc: W[0]=61626380, W[15]=00000018. 55 bytes fits one padded block; 56 bytes needs two. 2 / 7
Separate chain and working state Initialize chain from IV once per message. Every block starts from the previous chaining value. First abc round: T1=54da50e8, T2=08909ae5. New a=5d6aebcd, new e=fa2a4622; moves use old round values. Feed final working words back into the chain modulo 2^32. 3 / 7
Count continuation bytes Key 8 + message 3 = 11 original bytes. Glue has 53 bytes; known digest is a state after 64 bytes. Add a 2-byte suffix: continuation length field counts 66 bytes. Send message+glue+suffix; continue from 64, not 11. 4 / 7
Verify the Merkle claim Leaves H(00||data), nodes H(01||left||right). Sibling orientation matters. Duplicate-last makes [A,B,C] and [A,B,C,C] share a root. A proof establishes consistency with a root, not that root's trust or list size. 5 / 7
Encode the commitment 43 || uint64be(nonce length) || nonce || 4d || uint64be(message length) || message. Nonce aa and message OK use 21 bytes before SHA padding. Binding and hiding are separate claims. Public nonce plus 20 candidate messages still permits 20 candidate hashes. 6 / 7
Reconstruct and diagnose Original hashed length 60: predict glue and continuation length. Reversing a sibling changes the reconstructed ordered path. Resetting the IV per block can pass short tests and fail longer ones. Check independent vectors and fresh field-boundary cases. 7 / 7