Jack Lloyd

The way this is defined is pretty strange imo, and somewhat easy to implement in incorrect ways

Would lead to the downloaded crate being smaller anyway.

It's compressed for publication but (IIRC) using gzip, we can do quite a bit better with something like zstd.

We can just generate the structs directly, no more runtime serde.

Add more value barriers to avoid compiler induced side channels

7

The paper https://arxiv.org/pdf/2410.13489 claims that on specific architectures Clang and GCC may introduce jumps here. The donna128 issues only affect 32-bit processors, which explains why we would not see it...

Reduce risk of compiler value range propogation in FrodoKEM sampling

1

No compiler has been found to perform optimizations that introduce a side channel here, but the construct as written was somewhat risky.

Remove the BigInt based NIST reduction functions

1

Going forward the assumption is that if the user cares about ECC performance then pcurves is enabled.

k256 Schnorr / BIP340 doesn't handle the y odd case

5

For both signature generation and verification, `k256` doesn't seem to handle the case where the `y` coordinate of the public key is odd. I guess it is implicitly assuming that...