Michael Rosenberg

That is already checked in the assert at the top of the function. Should this be in addition or in the place of?

Actually here's a simple solution: rather than padding the input bytes, pad the input bits. The bits conversion is done anyway in both instances, so this is 0 overhead. I...

Note that the [more immediate reason](https://github.com/arkworks-rs/crypto-primitives/blob/main/src/merkle_tree/constraints.rs#L47) for this error is simply that `PathVar::new_variable` calls `and_then()` on its argument, regardless of the value of `mode`. But the bug remains even after...

Resolved in `release/4.0` branch

`Copy` can also appear in `conditional_select`, like in [this code](https://github.com/dalek-cryptography/subtle/pull/90/files#diff-b1a35a68f14e696205874893c07fd24fdb88882b47c23cc0e0c80a30c7d53759R525-R529) that implements `ConditionallySelectable` for all fixed-size arrays. If I understand correctly, Henry's [stated reasoning](https://github.com/dalek-cryptography/subtle/issues/56) is that allowing `Clone` types gives...

Agreed. A not-great idea: make a `trait SafeConditionallySelectable: Copy` and then make `trait ConditionallySelectable` unconstrainted. That way people can still write generics relying on `ConditionallySelectable`. And it'd be the case...

Oh, that's pretty nice. I'd be fine with that.

Ok here's more weirdness. If you recall, Trunk puts the following line in the `` of `index.html` (introduced in #147) ```html ``` If you remove the `crossorigin=""` at the end,...

Ah, that's cool. I wonder if it'd be sufficient to have a macro write that boilerplate

Yes, this is in keeping with CO15's definition of $k^i_j = H_{(S, R^i)}(whatever)$