diff --git a/src/curve.rs b/src/curve.rs
index 4f7126b..da10163 100644
--- a/src/curve.rs
+++ b/src/curve.rs
@@ -85,11 +85,11 @@ use core::cmp::{PartialEq, Eq};
 use constants;
 use field::FieldElement;
 use scalar::Scalar;
-use util::arrays_equal_ct;
-use util::bytes_equal_ct;
-use util::CTAssignable;
-use util::CTEq;
-use util::CTNegatable;
+use subtle::arrays_equal_ct;
+use subtle::bytes_equal_ct;
+use subtle::CTAssignable;
+use subtle::CTEq;
+use subtle::CTNegatable;
 
 // ------------------------------------------------------------------------
 // Compressed points
@@ -865,7 +865,7 @@ mod test {
     use test::Bencher;
     use field::FieldElement;
     use scalar::Scalar;
-    use util::CTAssignable;
+    use subtle::CTAssignable;
     use constants;
     use constants::BASE_CMPRSSD;
     use super::*;
diff --git a/src/field.rs b/src/field.rs
index 448c1ac..9ed0aea 100644
--- a/src/field.rs
+++ b/src/field.rs
@@ -24,10 +24,10 @@ use core::ops::{Index, IndexMut};
 use core::cmp::{Eq, PartialEq};
 use core::ops::Neg;
 
-use util::arrays_equal_ct;
-use util::byte_is_nonzero;
-use util::CTAssignable;
-use util::CTEq;
+use subtle::arrays_equal_ct;
+use subtle::byte_is_nonzero;
+use subtle::CTAssignable;
+use subtle::CTEq;
 
 /// FieldElements are represented as an array of ten "Limbs", which are radix
 /// 25.5, that is, each Limb of a FieldElement alternates between being
@@ -162,7 +162,7 @@ impl CTAssignable for FieldElement {
     ///
     /// ```
     /// # use curve25519_dalek::field::FieldElement;
-    /// # use curve25519_dalek::util::CTAssignable;
+    /// # use curve25519_dalek::subtle::CTAssignable;
     /// let f     = FieldElement([1,1,1,1,1,1,1,1,1,1]);
     /// let g     = FieldElement([2,2,2,2,2,2,2,2,2,2]);
     /// let mut h = FieldElement([1,1,1,1,1,1,1,1,1,1]);
@@ -174,7 +174,7 @@ impl CTAssignable for FieldElement {
     ///
     /// ```
     /// # use curve25519_dalek::field::FieldElement;
-    /// # use curve25519_dalek::util::CTAssignable;
+    /// # use curve25519_dalek::subtle::CTAssignable;
     /// # let f     = FieldElement([1,1,1,1,1,1,1,1,1,1]);
     /// # let g     = FieldElement([2,2,2,2,2,2,2,2,2,2]);
     /// # let mut h = FieldElement([1,1,1,1,1,1,1,1,1,1]);
@@ -815,7 +815,7 @@ impl FieldElement {
 mod test {
     use field::*;
     use test::Bencher;
-    use util::CTNegatable;
+    use subtle::CTNegatable;
 
     #[bench]
     fn bench_fieldelement_a_mul_a(b: &mut Bencher) {
diff --git a/src/lib.rs b/src/lib.rs
index 36e3a05..2007ada 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -47,9 +47,9 @@ pub mod field;
 pub mod curve;
 pub mod scalar;
 
-// Utilities module.
+// Constant-time functions and other miscelaneous utilities.
 
-pub mod util;
+pub mod subtle;
 
 // Low-level curve and point constants, as well as pre-computed curve group elements.
 
diff --git a/src/scalar.rs b/src/scalar.rs
index 33bf764..a1ec8d0 100644
--- a/src/scalar.rs
+++ b/src/scalar.rs
@@ -39,9 +39,9 @@ use rand::Rng;
 // XXX should these be in a utility module ?
 use constants;
 use field::{load3, load4};
-use util::CTAssignable;
-use util::CTEq;
-use util::arrays_equal_ct;
+use subtle::CTAssignable;
+use subtle::CTEq;
+use subtle::arrays_equal_ct;
 
 /// The `Scalar` struct represents an element in ℤ/lℤ, where
 ///
@@ -115,7 +115,7 @@ impl CTAssignable for Scalar {
     ///
     /// ```
     /// # use curve25519_dalek::scalar::Scalar;
-    /// # use curve25519_dalek::util::CTAssignable;
+    /// # use curve25519_dalek::subtle::CTAssignable;
     /// let a = Scalar([0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,
     ///                 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]);
     /// let b = Scalar([1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
diff --git a/src/util.rs b/src/subtle.rs
similarity index 92%
rename from src/util.rs
rename to src/subtle.rs
index a3db551..c46393a 100644
--- a/src/util.rs
+++ b/src/subtle.rs
@@ -9,7 +9,7 @@
 // - Isis Agora Lovecruft <isis@patternsinthevoid.net>
 // - Henry de Valence <hdevalence@hdevalence.ca>
 
-//! Utility functions and tools for constant-time comparisons.
+//! Constant-time traits and utility functions.
 
 use core::ops::Neg;
 
@@ -31,7 +31,7 @@ pub trait CTEq {
     fn ct_eq(&self, other: &Self) -> u8;
 }
 
-// Trait for items which can be conditionally negated in constant time.
+/// Trait for items which can be conditionally negated in constant time.
 ///
 /// Note: it is not necessary to implement this trait, as a generic
 /// implementation is provided.
@@ -55,7 +55,7 @@ impl<T> CTNegatable for T
 ///
 /// # Return
 ///
-/// Returns 1 if `a == b` and 0 otherwise.
+/// Returns `1u8` if `a == b` and `0u8` otherwise.
 #[inline(always)]
 pub fn bytes_equal_ct(a: u8, b: u8) -> u8 {
     let mut x: u8;
@@ -94,7 +94,7 @@ pub fn byte_is_nonzero(b: u8) -> u8 {
 ///
 /// # Return
 ///
-/// Returns 1 if `a == b` and 0 otherwise.
+/// Returns `1u8` if `a == b` and `0u8` otherwise.
 #[inline(always)]
 // We don't use this in curve25519-dalek, but it's useful for e.g. an ed25519 implementation.
 #[allow(dead_code)]