func HashInternalNode(prefixBits []bool, childHashes *[2][HashBytes]byte) []byte {
	h := sha3.NewShake256()
	h.Write([]byte{InternalNodeIdentifier})
	h.Write(childHashes[0][:])
	h.Write(childHashes[1][:])
	h.Write(ToBytes(prefixBits))
	buf := make([]byte, 4)
	binary.LittleEndian.PutUint32(buf, uint32(len(prefixBits)))
	h.Write(buf)
	var ret [HashBytes]byte
	h.Read(ret[:])
	return ret[:]
}
Differences from the CONIKS paper:
* Add an identifier byte at the beginning to make it impossible for this to collide with leaves
or empty branches.
* Add the prefix of the index, to protect against limited hash collisions or bugs.
This gives H(k_internal || h_child0 || h_child1 || prefix || depth)
package coname
import (
	"bytes"
	"encoding/binary"
	"fmt"
	"golang.org/x/crypto/sha3"
)
const (
	HashBytes  = 32
	IndexBytes = 32
	IndexBits  = IndexBytes * 8
)
type MerkleNode interface {
	IsEmpty() bool
	IsLeaf() bool
	Depth() int
	ChildHash(rightChild bool) []byte
	Child(rightChild bool) (MerkleNode, error)
	Index() []byte
	Value() []byte
}
func TreeLookup(root MerkleNode, indexBytes []byte) (value []byte, err error) {
	if len(indexBytes) != IndexBytes {
		return nil, fmt.Errorf("Wrong index length")
	}
	if root.IsEmpty() {
		return nil, nil
	}
	n := root
	indexBits := ToBits(IndexBits, indexBytes)
	for !n.IsLeaf() {
		descendingRight := indexBits[n.Depth()]
		n, err = n.Child(descendingRight)
		if err != nil {
			return nil, err
		}
		if n.IsEmpty() {
			return nil, nil
		}
	}
	if bytes.Equal(indexBytes, n.Index()) {
		return n.Value(), nil
	} else {
		return nil, nil
	}
}
const (
	InternalNodeIdentifier = 'I'
	LeafIdentifier         = 'L'
	EmptyBranchIdentifier  = 'E'
)