1 files changed, 58 insertions, 15 deletions

diff --git a/src/secp256k1.c b/src/secp256k1.c
index 0328db88fc..58bcd8d009 100644
--- a/src/secp256k1.c
+++ b/src/secp256k1.c
@@ -17,6 +17,7 @@
 #include "ecmult_gen_impl.h"
 #include "ecdsa_impl.h"
 #include "eckey_impl.h"
+#include "hash_impl.h"
 
 void secp256k1_start(unsigned int flags) {
     secp256k1_fe_start();
@@ -69,26 +70,54 @@ end:
     return ret;
 }
 
-int secp256k1_ecdsa_sign(const unsigned char *msg32, unsigned char *signature, int *signaturelen, const unsigned char *seckey, const unsigned char *nonce) {
+static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, unsigned int counter, const void *data) {
+   (void)data;
+   secp256k1_rfc6979_hmac_sha256_t rng;
+   secp256k1_rfc6979_hmac_sha256_initialize(&rng, key32, 32, msg32, 32);
+   for (unsigned int i = 0; i <= counter; i++) {
+       secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
+   }
+   secp256k1_rfc6979_hmac_sha256_finalize(&rng);
+   return 1;
+}
+
+const secp256k1_nonce_function_t secp256k1_nonce_function_rfc6979 = nonce_function_rfc6979;
+const secp256k1_nonce_function_t secp256k1_nonce_function_default = nonce_function_rfc6979;
+
+int secp256k1_ecdsa_sign(const unsigned char *msg32, unsigned char *signature, int *signaturelen, const unsigned char *seckey, secp256k1_nonce_function_t noncefp, const void* noncedata) {
     DEBUG_CHECK(secp256k1_ecmult_gen_consts != NULL);
     DEBUG_CHECK(msg32 != NULL);
     DEBUG_CHECK(signature != NULL);
     DEBUG_CHECK(signaturelen != NULL);
     DEBUG_CHECK(seckey != NULL);
-    DEBUG_CHECK(nonce != NULL);
+    if (noncefp == NULL) {
+        noncefp = secp256k1_nonce_function_default;
+    }
 
     secp256k1_scalar_t sec, non, msg;
     secp256k1_scalar_set_b32(&sec, seckey, NULL);
-    int overflow = 0;
-    secp256k1_scalar_set_b32(&non, nonce, &overflow);
     secp256k1_scalar_set_b32(&msg, msg32, NULL);
-    int ret = !secp256k1_scalar_is_zero(&non) && !overflow;
+    int overflow = 0;
+    int ret = 0;
+    unsigned int count = 0;
     secp256k1_ecdsa_sig_t sig;
-    if (ret) {
-        ret = secp256k1_ecdsa_sig_sign(&sig, &sec, &msg, &non, NULL);
+    while (1) {
+        unsigned char nonce32[32];
+        ret = noncefp(nonce32, msg32, seckey, count, noncedata);
+        if (!ret) {
+            break;
+        }
+        secp256k1_scalar_set_b32(&non, nonce32, &overflow);
+        memset(nonce32, 0, 32);
+        if (!secp256k1_scalar_is_zero(&non) && !overflow) {
+            if (secp256k1_ecdsa_sig_sign(&sig, &sec, &msg, &non, NULL)) {
+                break;
+            }
+        }
+        count++;
     }
     if (ret) {
-        secp256k1_ecdsa_sig_serialize(signature, signaturelen, &sig);
+        ret = secp256k1_ecdsa_sig_serialize(signature, signaturelen, &sig);
     }
     secp256k1_scalar_clear(&msg);
     secp256k1_scalar_clear(&non);
@@ -96,22 +125,36 @@ int secp256k1_ecdsa_sign(const unsigned char *msg32, unsigned char *signature, i
     return ret;
 }
 
-int secp256k1_ecdsa_sign_compact(const unsigned char *msg32, unsigned char *sig64, const unsigned char *seckey, const unsigned char *nonce, int *recid) {
+int secp256k1_ecdsa_sign_compact(const unsigned char *msg32, unsigned char *sig64, const unsigned char *seckey, secp256k1_nonce_function_t noncefp, const void* noncedata, int *recid) {
     DEBUG_CHECK(secp256k1_ecmult_gen_consts != NULL);
     DEBUG_CHECK(msg32 != NULL);
     DEBUG_CHECK(sig64 != NULL);
     DEBUG_CHECK(seckey != NULL);
-    DEBUG_CHECK(nonce != NULL);
+    if (noncefp == NULL) {
+        noncefp = secp256k1_nonce_function_default;
+    }
 
     secp256k1_scalar_t sec, non, msg;
     secp256k1_scalar_set_b32(&sec, seckey, NULL);
-    int overflow = 0;
-    secp256k1_scalar_set_b32(&non, nonce, &overflow);
     secp256k1_scalar_set_b32(&msg, msg32, NULL);
-    int ret = !secp256k1_scalar_is_zero(&non) && !overflow;
+    int overflow = 0;
+    int ret = 0;
+    unsigned int count = 0;
     secp256k1_ecdsa_sig_t sig;
-    if (ret) {
-        ret = secp256k1_ecdsa_sig_sign(&sig, &sec, &msg, &non, recid);
+    while (1) {
+        unsigned char nonce32[32];
+        ret = noncefp(nonce32, msg32, seckey, count, noncedata);
+        if (!ret) {
+            break;
+        }
+        secp256k1_scalar_set_b32(&non, nonce32, &overflow);
+        memset(nonce32, 0, 32);
+        if (!secp256k1_scalar_is_zero(&non) && !overflow) {
+            if (secp256k1_ecdsa_sig_sign(&sig, &sec, &msg, &non, recid)) {
+                break;
+            }
+        }
+        count++;
     }
     if (ret) {
         secp256k1_scalar_get_b32(sig64, &sig.r);