The MON-01-004 issue from Cure53's audit noted that Monocypher did not
compare to <https://github.com/Kleshni/Elligator-2>, which I didn't know
of at the time. Some test vectors were added back then, but full
interoperability was not yet ascertained. (Moreover, I though I'd added
vectors for the reverse map, and somehow didn't. This is now fixed.)
Now I have been able to generate decoding (direct map) test vectors from
Kleshni's implementation, that Monocypher matches perfectly. For the
inverse map however, I was not so lucky: Monocypher and Kleshni disagree
on quite a few points, including those used in Kleshni's test vectors.
Some investigation revealed that currently, Kleshni's encoding (inverse
map) is not reliable. In some cases, the round trip fails to yield the
same point we started with (and it's not just a matter of chopping off
the most significant bit).
However, Monocypher and Kleshni *do* agree on some points, which I have
added (and *checked* I have added) to the list of test vectors. There's
just one divergence left: Monocypher fails to encode the zero point,
which is a departure from the standard (we're supposed to output the
zero representative instead).