Why does only one of the two nonce points in MuSig2 have the exponent b?

Question

In MuSig2 R''_i is added to itself b times (in multiplicative notation, it has the exponent b) but R'_i is not (it does not have the exponent b).

Why does only one of the nonce points have the exponent b and not both? I was expecting:

R_i = (R'_i.R''_i)^b

I'm assuming it saves on exponentiations and somehow offers the same security (because b is hashing both R'_i and R''_i)?

(R_i is the generator point G added to itself r_i times where r_i is the nonce. Or R_i = g^r_i in multiplicative notation.)

The following is taken from Tim Ruffing's slides at Real World Crypto 2021:

Answer 1

A slight variant of MuSig2, named MuSig2*, sets one of the coefficients to 1 to make the key aggregation function slightly more efficient. This is described in a draft specification of MuSig2 : ↩

MuSig2* optimization: The specification uses an optimization that allows saving a point multiplication in key aggregation. The MuSig2 scheme with this optimization is called MuSig2* and proven secure in the appendix of the MuSig2 paper. The optimization is that the second distinct key in the list of public keys given to the key aggregation algorithm (as well as any keys identical to this key) gets the constant key aggregation coefficient 1.

I was myself confused by this when writing my blog post about MuSig2.

This trick resembles normalization of a polynomial, which is accomplished by dividing each term by the first terms' coefficient.