To quote Ilari on the CFRG mailing list:
e.g. the vile mess that is ECDSA with SHA-3
I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
The issue seems to be that ECDSA uses bit strings in several places, and SHA-3 uses a surprising bit-string to octet-string conversion. This is exacerbated by the fact that the ECDSA spec is not freely available.
The strangeness of SHA-3 seems to be that the bit order in which SHA-3 expects bytes requires flipping them around compared to the bit order that is used pretty much everywhere else. In other words, the messages are defined as bits but computers deal with bytes so if you change MSB/LSB of the message you not only need to change endianness but you need to flip all the bytes around.
I cannot easily verify this but it's worth being aware of for implementations so I am posting it anyway.