> we were even arguing about endianness for God's sake
Why is that? Where you scared that developers might have made mistake while typing constants in their implementations?
Why is that? Where you scared that developers might have made mistake while typing constants in their implementations?
Since X25519 and Ed25519 had already been deployed by a fair few people, all of whom used little-endian, recommending the opposite without a compelling reason would have been a bit too silly. (Upstream working groups are encouraged to consider the field elements as opaque octet strings, to try to avoid arguing the exact same point again.)