How is the Merkle Branch stored in the wallet?

[JollyGreen]

I'm trying to grasp how a transaction can be linked back to the root merkle hash stored in a block in the block chain.

Is the merkle branch for my transaction not stored in my wallet until after someone on the network has included my transaction in a new block?  (I guess this is obvious, but looking for validation)

When a node is creating a new block with my transaction how does it go about creating the merkle tree, is that arbitrary?  Does the block creator only include transactions he wants in any order he wants?

Assuming I understand this correctly, once the block is created does the block creator then send out a merkle branch to each person involved in a transaction contained in that block?

When a merkle branch is stored in a wallet, I assume it stores the hash at each level of the branch, does it also store something that links the hash at that level to another transaction in that block?

It seems like if something isn't stored that links a hash at a level in my merkle branch to a transaction then I would only need to spoof one hash in my merkle branch to convince someone a spoofed transaction was in the block chain.  Does that make sense?

I'm new to Bitcoin, just trying to clear up some questions

[theymos]

Looking at the ASCII picture of a Merkle tree on this page might help you understand:
https://en.bitcoin.it/wiki/Dump_format#CBlock
Notice that the transaction hashes are added to the bottom of the tree in order of where they appeared in the block.

Is the merkle branch for my transaction not stored in my wallet until after someone on the network has included my transaction in a new block?  (I guess this is obvious, but looking for validation)

Right.

When a node is creating a new block with my transaction how does it go about creating the merkle tree, is that arbitrary?  Does the block creator only include transactions he wants in any order he wants?

The order is arbitrary, though Bitcoin currently sorts them by time of acceptance. The structure of the tree is based on the transactions: given the same transaction hashes in the same order, you will calculate the same tree.

Assuming I understand this correctly, once the block is created does the block creator then send out a merkle branch to each person involved in a transaction contained in that block?

No. They publish the block, which contains the transactions. Everyone downloads the block and generates the Merkle tree from the transactions. Trees aren't normally transmitted over the network.

Lightweight clients throw away the block once they've generated the tree. Ultra-lightweight clients that don't download full blocks rely on the sender of BTC to give them the Merkle branch by some means.

When a merkle branch is stored in a wallet, I assume it stores the hash at each level of the branch, does it also store something that links the hash at that level to another transaction in that block?

I'm not sure what you mean. The Merkle tree contains transaction hashes (at the very bottom of the tree), which are for transactions in the block.

It seems like if something isn't stored that links a hash at a level in my merkle branch to a transaction then I would only need to spoof one hash in my merkle branch to convince someone a spoofed transaction was in the block chain.  Does that make sense?

You would "only" need to spoof one hash, but you'd need to modify the tree in such a way that the Merkle root remains the same. This is nearly impossible.

[theymos]

I'm not sure where I read it, but somehow I thought that the block chain only consisted of the headers and no transactions.  I thought I read somewhere that the merkle branch for your transactions was stored in your wallet so you could prove your transaction was part of a merkle tree connected to the merkle hash in one of the blocks in the block chain.  Maybe that is the case of pruning?

It's possible to operate with just the block headers and the Merkle branches for your transactions, but Bitcoin currently always downloads the full blocks, which contain all transactions.

The purpose of storing the Merkle branch for a transaction is to know how many confirmations it has. When you receive a transaction while operating without full blocks, you can't check whether it is valid, so you see whether it gets enough confirmations.

I was reading "Simplified Payment Verification" in "Bitcoin: A Peer-to-Peer Electronic Cash System".  They say you need to obtain the Merkle Branch for your transactions.  How would you go about doing that?

Lightweight clients download every recent full block, but then throw away everything but the header and the tree after they calculate the tree.

Ultra-lightweight clients download just the headers. They must receive transactions using IP transfers (or some not-yet-invented method), which sends the Merkle branch.