@@ -39,10 +39,10 @@ /// Number of filed elements used to encode a nonce.
 const NONCE_ELEMENTS: usize = 8;
 
 /// Public key length as a u8 vector.
-const PK_LEN: usize = 897;
+pub const PK_LEN: usize = 897;
 
 /// Secret key length as a u8 vector.
-const SK_LEN: usize = 1281;
+pub const SK_LEN: usize = 1281;
 
 /// Signature length as a u8 vector.
 const SIG_LEN: usize = 626;

@@ -4,7 +4,7 @@
 // FALCON POLYNOMIAL
 // ================================================================================================
 
-/// A polynomial over Z_p[x]/(phi) where phi := x^512 + 1
+/// A polynomial over Z_p\[x\]/(phi) where phi := x^512 + 1
 #[derive(Debug, Copy, Clone, PartialEq)]
 pub struct Polynomial([u16; N]);
 
@@ -24,7 +24,7 @@
         Self(data)
     }
 
-    /// Decodes raw bytes representing a public key into a polynomial in Z_p[x]/(phi).
+    /// Decodes raw bytes representing a public key into a polynomial in Z_p\[x\]/(phi).
     ///
     /// # Errors
     /// Returns an error if:
@@ -69,14 +69,14 @@ Err(FalconError::PubKeyDecodingExtraData)
         }
     }
 
-    /// Decodes the signature into the coefficients of a polynomial in Z_p[x]/(phi). It assumes
+    /// Decodes the signature into the coefficients of a polynomial in Z_p\[x\]/(phi). It assumes
     /// that the signature has been encoded using the uncompressed format.
     ///
     /// # Errors
     /// Returns an error if:
     /// - The signature has been encoded using a different algorithm than the reference compressed
     ///   encoding algorithm.
-    /// - The encoded signature polynomial is in Z_p[x]/(phi') where phi' = x^N' + 1 and N' != 512.
+    /// - The encoded signature polynomial is in Z_p\[x\]/(phi') where phi' = x^N' + 1 and N' != 512.
     /// - While decoding the high bits of a coefficient, the current accumulated value of its
     ///  high bits is larger than 2048.
     /// - The decoded  coefficient is -0.
@@ -149,12 +149,12 @@
     // POLYNOMIAL OPERATIONS
     // --------------------------------------------------------------------------------------------
 
-    /// Multiplies two polynomials over Z_p[x] without reducing modulo p. Given that the degrees
+    /// Multiplies two polynomials over Z_p\[x\] without reducing modulo p. Given that the degrees
     /// of the input polynomials are less than 512 and their coefficients are less than the modulus
     /// q equal to 12289, the resulting product polynomial is guaranteed to have coefficients less
     /// than the Miden prime.
     ///
-    /// Note that this multiplication is not over Z_p[x]/(phi).
+    /// Note that this multiplication is not over Z_p\[x\]/(phi).
     pub fn mul_modulo_p(a: &Self, b: &Self) -> [u64; 1024] {
         let mut c = [0; 2 * N];
         for i in 0..N {
@@ -166,8 +166,8 @@
         c
     }
 
-    /// Reduces a polynomial, that is the product of two polynomials over Z_p[x], modulo
-    /// the irreducible polynomial phi. This results in an element in Z_p[x]/(phi).
+    /// Reduces a polynomial, that is the product of two polynomials over Z_p\[x\], modulo
+    /// the irreducible polynomial phi. This results in an element in Z_p\[x\]/(phi).
     pub fn reduce_negacyclic(a: &[u64; 1024]) -> Self {
         let mut c = [0; N];
         for i in 0..N {
@@ -181,7 +181,7 @@
         Self(c)
     }
 
-    /// Computes the norm squared of a polynomial in Z_p[x]/(phi) after normalizing its
+    /// Computes the norm squared of a polynomial in Z_p\[x\]/(phi) after normalizing its
     /// coefficients to be in the interval (-p/2, p/2].
     pub fn sq_norm(&self) -> u64 {
         let mut res = 0;
@@ -203,7 +203,7 @@ Self([0_u16; N])
     }
 }
 
-/// Multiplication over Z_p[x]/(phi)
+/// Multiplication over Z_p\[x\]/(phi)
 impl Mul for Polynomial {
     type Output = Self;
 
@@ -227,7 +227,7 @@ Polynomial(result)
     }
 }
 
-/// Addition over Z_p[x]/(phi)
+/// Addition over Z_p\[x\]/(phi)
 impl Add for Polynomial {
     type Output = Self;
 
@@ -239,7 +239,7 @@ res
     }
 }
 
-/// Subtraction over Z_p[x]/(phi)
+/// Subtraction over Z_p\[x\]/(phi)
 impl Sub for Polynomial {
     type Output = Self;
 

@@ -11,7 +11,7 @@ // ================================================================================================
 
 /// An RPO Falcon512 signature over a message.
 ///
-/// The signature is a pair of polynomials (s1, s2) in (Z_p[x]/(phi))^2, where:
+/// The signature is a pair of polynomials (s1, s2) in (Z_p\[x\]/(phi))^2, where:
 /// - p := 12289
 /// - phi := x^512 + 1
 /// - s1 = c - s2 * h
@@ -86,7 +86,7 @@
     // HASH-TO-POINT
     // --------------------------------------------------------------------------------------------
 
-    /// Returns a polynomial in Z_p[x]/(phi) representing the hash of the provided message.
+    /// Returns a polynomial in Z_p\[x\]/(phi) representing the hash of the provided message.
     pub fn hash_to_point(&self, message: Word) -> Polynomial {
         hash_to_point(message, &self.nonce())
     }

@@ -19,7 +19,7 @@
 // MERKLE TREE DELTA
 // ================================================================================================
 
-/// [MerkleDelta] stores the differences between the initial and final Merkle tree states.
+/// [MerkleTreeDelta] stores the differences between the initial and final Merkle tree states.
 ///
 /// The differences are represented as follows:
 /// - depth: the depth of the merkle tree.
@@ -47,7 +47,7 @@ }
 
     // ACCESSORS
     // --------------------------------------------------------------------------------------------
-    /// Returns the depth of the Merkle tree the [MerkleDelta] is associated with.
+    /// Returns the depth of the Merkle tree the [MerkleTreeDelta] is associated with.
     pub fn depth(&self) -> u8 {
         self.depth
     }
@@ -75,7 +75,7 @@ self.updated_slots.push((index, value));
     }
 }
 
-/// Extracts a [MerkleDelta] object by comparing the leaves of two Merkle trees specifies by
+/// Extracts a [MerkleTreeDelta] object by comparing the leaves of two Merkle trees specifies by
 /// their roots and depth.
 pub fn merkle_tree_delta<T: KvMap<RpoDigest, StoreNode>>(
     tree_root_1: RpoDigest,

@@ -1,16 +1,16 @@
 use super::super::{RpoDigest, Vec};
 
-/// Container for the update data of a [PartialMmr]
+/// Container for the update data of a [super::PartialMmr]
 #[derive(Debug)]
 pub struct MmrDelta {
-    /// The new version of the [Mmr]
+    /// The new version of the [super::Mmr]
     pub forest: usize,
 
     /// Update data.
     ///
     /// The data is packed as follows:
     /// 1. All the elements needed to perform authentication path updates. These are the right
-    ///    siblings required to perform tree merges on the [PartialMmr].
+    ///    siblings required to perform tree merges on the [super::PartialMmr].
     /// 2. The new peaks.
     pub data: Vec<RpoDigest>,
 }

@@ -163,7 +163,7 @@
 // MERKLE PATH CONTAINERS
 // ================================================================================================
 
-/// A container for a [Word] value and its [MerklePath] opening.
+/// A container for a [crate::Word] value and its [MerklePath] opening.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct ValuePath {
     /// The node value opening for `path`.
@@ -179,7 +179,7 @@ Self { value, path: MerklePath::new(path) }
     }
 }
 
-/// A container for a [MerklePath] and its [Word] root.
+/// A container for a [MerklePath] and its [crate::Word] root.
 ///
 /// This structure does not provide any guarantees regarding the correctness of the path to the
 /// root. For more information, check [MerklePath::verify].

@@ -19,7 +19,7 @@
 // RPO RANDOM COIN
 // ================================================================================================
 /// A simplified version of the `SPONGE_PRG` reseedable pseudo-random number generator algorithm
-/// described in https://eprint.iacr.org/2011/499.pdf.
+/// described in <https://eprint.iacr.org/2011/499.pdf>.
 ///
 /// The simplification is related to the following facts:
 /// 1. A call to the reseed method implies one and only one call to the permutation function.