def sign_p

bend-collections-laws-crypto@1.0.0.0 · spec/crypto/secp256k1/schnorr.bend:149

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/curve.bend as CV

149# P = d' G; d = d' if has_even_y(P), otherwise n - d';
150# t = bytes(d) xor hash_aux(a); rand = hash_nonce(t || bytes(P) || m)
151def sign_p(+one: Nat, +d0: Nat, +m: List<&2, U32>, +aux: List<&2, U32>, pa: CV.SAffine) -> Maybe<&2, List<&2, U32>>:
152  match pa:
153    case CV.SAffine{px, +py}:
154      +d = even(n(one), py, d0)
155      +pb = bytes32(px)
156      +t = xor_bytes(bytes32(d), tagged(tag_aux(), aux))
157      sign_k(one, d, pb, m, Nat.mod(CV.os2ip(tagged(tag_nonce(), cat(t, cat(pb, m)))), n(one)))