schnorr signatures – Ought to a good Y coordinate be enforced after each key-tweak operation, or solely on the finish?

It is a very area of interest query concerning BIP340 and key tweaking with even-only public keys.

I really feel my query could also be a matter of opinion, since there does not look like an accepted proper / fallacious solution to do issues.

Key Tweaking

As an instance that you simply need to apply a sequence of tweaks to a secret key, and the returned key must have a good Y coordinate.

You might have two operations accessible:

• [tweak] secret key (sec * tweak % N)
• [negate?] secret key (if pub(sec) == odd then sec * (N – 1))

You possibly can apply the tweaks in two attainable methods:

• 1. [tweak], [tweak], [negate?]
• 2. [tweak], [negate?], [tweak], [negate]

Each options are legitimate, and can produce the specified key. Nonetheless, neither answer is appropriate with the opposite, so all events should agree on which technique to make use of.

So what’s the accepted answer right here? The primary answer requires much less operations, however the second answer may additionally have some profit?

The idea of even-only public keys is comparatively new, so I am unsure what the clear consensus is right here.

Any suggestions can be tremendously appreciated!