Add running code for Merkle section of the spec

[abhvious]

No description provided.

[TallTed]

I note inconsistent use of .. (not really an ellipsis) and ... (ellipsis) for sequences. I recognize that some programming languages and user interfaces use two dots as a range operator, but I think this causes confusion for readers who are not familiar with those specific programming languages and user interfaces, so I suggest that the two-dots not be used at all. I suggest that ... (three dots, preferred) or … (a single-character ellipsis) should be used in such cases.

When an ellipsis (whether … or ...) follows a comma, I suggest that there be a space between, i.e., immediately preceding the ellipsis, as blah, ....

When an ellipsis is followed by any character other than a terminating . (single dot a/k/a full stop) or other punctuation mark, I suggest that the ellipsis be immediately followed by a space, as ... blah or ...! or ...? or ... i[k-1].

For most (probably all) of the above cases,   should be used instead of wherever a browser-rendered line break might make the punctuation harder for a human reader to parse.

(EDITted to fix autocorrect's miscorrections of ellipsis to ellipse.)

[abhvious]

Apologies that my other changes for the f-s section are also being added to this PR.

-- the e123 commit fixes your issue. I'll also wait for comments on the FS changes on this PR before merging.

Thank you for your careful review.

[TallTed]

• indicies is a misspelling of indices
• rules for spacing around ellipses was misunderstood

Suggested change

This section describes how to verify a compressed Merkle proof. The claim to verify is that "the commitment `root` defines an `n`-leaf Merkle tree that contains `k` digests `s[0], ...,s[k-1]` at corresponding indicies `i[0], ...,i[k-1]`." The strategy of this verification procedure is to deduce which nodes are needed along the `k` verification paths from index to root, then read these values from the purported proof, and then recompute the Merkle tree and the consistency of the `root` digest. As an optimization, the `defined[]` array avoids recomputing internal portions of the Merkle tree that are not relevant to the verification. By convention, a proof for the degenerate case of `k=0` digests is defined to fail. It is assumed that the `indicies[]` array does not contain duplicates.

This section describes how to verify a compressed Merkle proof. The claim to verify is that "the commitment `root` defines an `n`-leaf Merkle tree that contains `k` digests `s[0], ..., s[k-1]` at corresponding indices `i[0], ..., i[k-1]`." The strategy of this verification procedure is to deduce which nodes are needed along the `k` verification paths from index to root, then read these values from the purported proof, and then recompute the Merkle tree and the consistency of the `root` digest. As an optimization, the `defined[]` array avoids recomputing internal portions of the Merkle tree that are not relevant to the verification. By convention, a proof for the degenerate case of `k=0` digests is defined to fail. It is assumed that the `indices[]` array does not contain duplicates.

[TallTed]

Suggested change

	The last step of the prove method is for the verifier to select a subset of unique indicies (i.e., they are sampled without replacement) from the range `DBLOCK...NCOL` and request that the prover open these columns of tableau `T`. These opened columns are then used to verify consistency with the previous messages sent by the prover.
	The last step of the prove method is for the verifier to select a subset of unique indices (i.e., they are sampled without replacement) from the range `DBLOCK...NCOL` and request that the prover open these columns of tableau `T`. These opened columns are then used to verify consistency with the previous messages sent by the prover.

[TallTed]

lgtm, modulo a couple of new suggestions