ebfull

I've also tested that this implementation (of personalization) is consistent with [another implementation](https://github.com/zcash-hackworks/sapling-crypto/blob/master/src/circuit/blake2s.rs) I have.

The paper needs to be updated to be more clear about this.

The paper will be updated with some information related to this question.

### Design 1 In `Sync`, you can transition to `P` by sending a discriminant over the channel and transitioning to `Latent`. After you receive a discriminant back, regardless of what...

### Design 2 `Duplex` is a session that allows two protocols to be interacted with concurrently. The `Duplex` holds the environment for both sessions. Either side can _immediately_ send on...

#### Design 2: Take 2 --- `Duplex` is a session type which allows _both_ `S` and `Q` to be interacted over concurrently via a single channel. Its `Dual` is `Duplex`....

Done, but now I need to do some trick that looks like this: ``` rust proto!( Atm = { Recv usize, Send usize, Fun = { Recv i8, Send i8,...

I can only recommend **destroying the machine afterward**, which is something most of us need to do anyway in anticipation of backdoors. As is stated on the `powersoftau` README: >...

That's very cool! I'll review this soon. In the mean time, @devrandom might have some comments or suggestions.

Note that changing the serialization of the verification key to resolve this issue will be incompatible with older proofs, because the verification key is serialized in order to initialize the...