Root & Leaf

Leaf Binds Server Share

The toy leaf certificate binds one server share value.

highlighted = computed this step

The leaf names what is being trusted

The toy leaf certificate binds a small leaf id to the server share.

leaf binds share\text{leaf binds share}
Leaf binds server shareThe toy root-to-leaf chain is recomputed from the signed digest.Leaf binds server share - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22

Read the leaf id

The leaf id is 14. It is part of the signed check value.

leaf id=14\text{leaf id}=14
Leaf binds server shareThe toy root-to-leaf chain is recomputed from the signed digest.Leaf binds server share - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22

Read the server share

The server share is 19. The leaf is meant to bind that exact value.

server share=19\text{server share}=19
Leaf binds server shareThe toy root-to-leaf chain is recomputed from the signed digest.Leaf binds server share - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22

Summary

The leaf does not just exist; it binds one exact server share in this toy model.

bound share=19\text{bound share}=19
Leaf binds server shareThe toy root-to-leaf chain is recomputed from the signed digest.Leaf binds server share - root verifies leafToy Root CAn=55, e=3Leaf cert binds share 19digest=33, sig=22