is something different with Schnorr regarding signature verification using public key?
i don't have any code to test ECSDSA but i could check ECDSA and in there you can't use -P for verification or it fails.
in other words if we use 32 byte public keys then we have no way of knowing which Y is the correct answer, as a result we would have 2 public key points (P and -P) one of which fails the verification.
so how did the discussion solve this?
Given a public/private key pair, by negating the private key, you can obtain another public key that has the same X coordinate but a Y coordinate that is of opposite oddness. For example, if key k has a pubkey P where the Y coordinate is odd, then the key -k has a public key with the same X but the Y is even.i don't have any code to test ECSDSA but i could check ECDSA and in there you can't use -P for verification or it fails.
in other words if we use 32 byte public keys then we have no way of knowing which Y is the correct answer, as a result we would have 2 public key points (P and -P) one of which fails the verification.
so how did the discussion solve this?
Knowing that, the solution is to dictate that all 32 byte public keys must use the even Y value. For signing, if the pubkey has an odd Y value, then the signer just negates the private key. For verifiers, when computing the Y value, they choose the even one.
