I have created a raw transaction, added the hash code, and Double-sha256 this result. Now I should sign this hash with the private key, which would give me the DER encoded signature, but I'm not clear on what exactly I should be doing. How do I SIGN this hash with the private key? What exactly would I be doing? I am not using any crypto library, except for SHA256, and I have implemented secp256k1 my self, so I guess in relation to that, what should I be doing with the private key and the hash? I am specifically aimed at step 15. If I were to guess, this and this are essentially my answer, unless I am mistaken, and if I am, I would like to know why. Otherwise, the caveat with those answers is the introduction of a random nonce. Why could I not just have the private key = "k" (since you shouldn't reuse addresses anyway, right?), calculate "s", and concatenate "r" and "s"? Or is this how it IS done?
It is not the
sha256(sha256(tx_bytes)) that needs to be signed. You need to follow the specific algorithm defined inside of Bitcoin core to produce a proper digital signature. Here is where the signature encoding algorithm is defined. Notice, that this algorithm changes slightly based on the
hash type you provide. This allows us functionality to include (or prevent inclusion) of extra inputs/outputs on a transaction.
This would be the answer I am looking for, with a helper link for the first function (signature generation algorithm), and a helper link for the second function (rfc6979 standard for generating "k"):
def ecdsa_sign(val, secret_exponent): """Return a signature for the provided hash, using the provided random nonce. It is absolutely vital that random_k be an unpredictable number in the range [1, self.public_key.point.order()-1]. If an attacker can guess random_k, he can compute our private key from a single signature. Also, if an attacker knows a few high-order bits (or a few low-order bits) of random_k, he can compute our private key from many signatures. The generation of nonces with adequate cryptographic strength is very difficult and far beyond the scope of this comment. May raise RuntimeError, in which case retrying with a new random value k is in order. """ G = ecdsa.SECP256k1 n = G.order() k = deterministic_generate_k(n, secret_exponent, val) p1 = k * G r = p1.x() if r == 0: raise RuntimeError("amazingly unlucky random number r") s = ( ecdsa.numbertheory.inverse_mod( k, n ) * ( val + ( secret_exponent * r ) % n ) ) % n if s == 0: raise RuntimeError("amazingly unlucky random number s") return signature_to_der(r, s) def deterministic_generate_k(generator_order, secret_exponent, val, hash_f=hashlib.sha256): """ Generate K value according to https://tools.ietf.org/html/rfc6979 """ n = generator_order order_size = (bit_length(n) + 7) // 8 hash_size = hash_f().digest_size v = b'\x01' * hash_size k = b'\x00' * hash_size priv = intbytes.to_bytes(secret_exponent, length=order_size) shift = 8 * hash_size - bit_length(n) if shift > 0: val >>= shift if val > n: val -= n h1 = intbytes.to_bytes(val, length=order_size) k = hmac.new(k, v + b'\x00' + priv + h1, hash_f).digest() v = hmac.new(k, v, hash_f).digest() k = hmac.new(k, v + b'\x01' + priv + h1, hash_f).digest() v = hmac.new(k, v, hash_f).digest() while 1: t = bytearray() while len(t) < order_size: v = hmac.new(k, v, hash_f).digest() t.extend(v) k1 = intbytes.from_bytes(bytes(t)) k1 >>= (len(t)*8 - bit_length(n)) if k1 >= 1 and k1 < n: return k1 k = hmac.new(k, v + b'\x00', hash_f).digest() v = hmac.new(k, v, hash_f).digest()
what should I be doing with the private key and the hash?
there is such method in any crypto-lib
for more information refer to Redeeming a raw transaction step by step example required step #15