Below is the CECKey::Sign() code (v0.9.3).

bool Sign(const uint256 &hash, std::vector<unsigned char>& vchSig) {
    ECDSA_SIG *sig = ECDSA_do_sign((unsigned char*)&hash, sizeof(hash), pkey);
    if (sig == NULL)
        return false;
    BN_CTX *ctx = BN_CTX_new();
    const EC_GROUP *group = EC_KEY_get0_group(pkey);
    BIGNUM *order = BN_CTX_get(ctx);
    BIGNUM *halforder = BN_CTX_get(ctx);
    EC_GROUP_get_order(group, order, ctx);
    BN_rshift1(halforder, order);
    if (BN_cmp(sig->s, halforder) > 0) {
        // enforce low S values, by negating the value (modulo the order) if above order/2.
        BN_sub(sig->s, order, sig->s);
    unsigned int nSize = ECDSA_size(pkey);
    vchSig.resize(nSize); // Make sure it is big enough
    unsigned char *pos = &vchSig[0];
    nSize = i2d_ECDSA_SIG(sig, &pos);
    vchSig.resize(nSize); // Shrink to fit actual size
    return true;

How could I specify which nonce is used in the ECDSA_do_sign()? By nonce, I am referring to the k value described here: http://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm.

  • 1
    At a guess, just looking at the code you pasted, the magic is in ECDSA_do_sign(). I believe that 0.9.3 does its signing through OpenSSL, so you may have to do a bunch of digging. You may also want to look at the code in the master branch---I think it currently does deterministic nonce generation using Pieter Wuille's libsecp256k1. Dec 8 '14 at 15:54
  • 1
    If you're going to use your own k, I urge you and others to use RFC6979. Dec 11 '14 at 23:46

ECDSA_do_sign() does not allow specifying the nonce. You can use ECDSA_do_sign_ex(), which needs extra arguments for (k*G).x and 1/k instead.

Bitcoin master recently switched to the libsecp256k1 library for signing, which always needs the nonce passed explicitly, and does not require precomputation of the x coordinate and inverse. See the code in Bitcoin Core for signing: https://github.com/bitcoin/bitcoin/blob/0a1d03ca5265293e6419b0ffb68d277da6b1d9a0/src/key.cpp#L75-L92

Disclaimer: I'm the author of libsecp256k1.

Edit: this answer is now outdated. libsecp256k1 now computes the nonce automatically using a nonce function. The default nonce function is RFC6979-based. It is no longer possible to specify the nonce directly, as this is dangerous practice.

  • Can you show (or give a link to) an example using that library to sign with a given nonce? Thanks!
    – morsecoder
    Dec 11 '14 at 0:36
  • Updated the post. Dec 11 '14 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.