The append-only Merkle log

A transparency log is a Merkle tree over append-only entries. Each entry gets a sequence number; the operator publishes a signed tree head after every append. Because each head commits to the entire prefix of history, an operator cannot insert, remove, or reorder entries without producing two heads that are mutually inconsistent — and anyone holding both can prove it.

Confium’s confium-transparency implements the RFC 6962 tree shape: entries are domain-separated, internal nodes hash L || R with the RFC’s prefixes, and heads carry the tree size plus root hash.

Related: inclusion and consistency proofs and consistency proof verification notes.