Using the Merkle Root to prove the integrity of a block's transactions

Question

I understand that a Merkle Root is the hash of hashes of hashes (etc.) of transaction pairings within a block that ultimately results in one 'Root' hash. Changing anything about any of the original transaction hashes would result in a completely different root hash.

What I'm still confused about is working backwards starting with the root hash to prove a certain transaction was included in the block. From the 'What is the Merkle Root?" thread, I understand the example of only needing 4 hashes to prove that Tk was included in the block (16 transaction block).

My questions are:

1. If every transaction is to be verified that it's included in the block, wouldn't you ultimately need to know all of the hashes anyway if you're going to trace back to each transaction separately?

2. Are these verifications only happening on request? or is it automatic before the block is added to the blockchain?

3. When verifying one specific transaction, where do you go to get the various sub-hashes for the necessary merkle branches?

Answer 1

If every transaction is to be verified that it's included in the block, wouldn't you ultimately need to know all of the hashes anyway if you're going to trace back to each transaction separately?

A full node downloads the entire contents of the block, which includes all of the transactions. Having done that, the node can easily compute the merkle root for the block (this is required to ensure the block is valid). Note that the intermediate level hashes in the merkle tree (between the leaves and the root) do not need to be communicated, a node with the full tx list can generate and verify the entire merkle tree itself against the merkle root listed in the block header.

Are these verifications only happening on request? or is it automatic before the block is added to the blockchain?

A full node will verify a block's contents, and only accept valid blocks. A wallet that uses spv will not perform the full block verification (that would entail downloading the full block), and instead trusts that the valid block headers it is receiving from full nodes in the network are indeed representative of the longest valid chain.

When verifying one specific transaction, where do you go to get the various sub-hashes for the necessary merkle branches?

A wallet using spv will request the relevant info from the full nodes it pulls network data from.