[jayflux]

> Instead, the attacker computes R_last(target-digest), and checks that against all the endpoints (last hash) of all column.

Wouldn’t R_last generate text? Why would you compare the text to last hash? Wouldn’t you just compare the target-digest to the last hash directly? (Nice explanation but I got lost here)

[sangel]

You are right. I'm missing an H at the end.

You first compare target-digest with all endpoints. If it's a match with any of them, good. Then you know a pre-image is in that column.

If not, then try H(R_last(target-digest)). Does it match any endpoint?

If not, then try H(R_last(H(R_second-to-last(target-digest))).

Rinse and repeat.