Encoding for twisted Edwards curve points

[secure12]

The source code of twisted Edwards curve points encoding points to RFC8032, which is based on the Ed25519 paper. It seems like gnark-crypto determines an x-coordinate of a point to be negative iff x > (q-1)/2 where q is the order of the group the coordinate is defined.

However, the Ed25519 paper suggests that the negative elements should instead be those whose integer representation in odd (see page 6 of the Ed25519 paper).

If q is an odd prime and the encoding is the
little-endian representation of {0, 1, . . . , q − 1} then the negative elements of Fq
are {1, 3, 5, . . . , q − 2}.

The test vectors in RFC8032 also suggests that the "odd encoding" is the correct one (at least for Ed25519 and Ed448).
Should there be an option to encode/decode the points with the alternative encoding instead?

[ivokub]

cc. @yelhousni. I'm not sure we have backwards compatibility considerations? Maybe we could just follow the RFC without implementing options.

[yelhousni]

the twisted Edwards curves implemented in gnark-crypto and gnark serve a very particular goal: verifying EdDSA signatures in a SNARK. Ed25519 is not implemented and we didn't follow the RFC. This is said, if no backward incompatibility, following an RFC should be a good idea. Contributions to gnark are always welcome!