Bitcoin

schnorr signature – Should even Y coordinates be applied after every key adjustment operation, or only at the end?

This is a very niche question about key reconciliation using BIP340 and even public keys.

I think my question may be a matter of opinion. Because there seems to be no recognized right or wrong way to do things.

key adjustment

Let’s say you want to apply a set of adjustments to a secret key, but you want the Y coordinate of the returned key to be even.

Two actions are available:

  • (Adjust) Secret Key (Seconds * Adjust %N)
  • (Negative?) Secret key (pub(sec) == sec * (N – 1) if odd)

You can apply tweaks in two ways:

    1. (adjustment), (adjustment), (negation?)
    1. (adjustment), (negation?), (adjustment), (negation)

Both solutions are valid and produce the desired key. However, neither solution is compatible with the other, so all parties must agree on which method to use.

So what is the acceptable solution here? Although the first solution requires less work, the second solution may have some advantages as well.

The concept of even-only public keys is relatively new, so I’m not sure what the clear consensus is here.

Any feedback would be greatly appreciated!

Related Articles

Back to top button