def sign_r

bend-collections-laws-crypto@1.0.0.0 · spec/crypto/secp256k1/schnorr.bend:130

import Base
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/field.bend as FS
import bend-collections-laws-crypto@1.0.0.0/spec/crypto/secp256k1/curve.bend as CV

130# R = k' G; k = k' if has_even_y(R), otherwise n - k';
131# e = int(hash_challenge(bytes(R) || bytes(P) || m)) mod n
132def sign_r(+one: Nat, +d: Nat, +pb: List<&2, U32>, +m: List<&2, U32>, +k0: Nat, ra: CV.SAffine) -> Maybe<&2, List<&2, U32>>:
133  match ra:
134    case CV.SAffine{rx, +ry}:
135      +k = even(n(one), ry, k0)
136      +rb = bytes32(rx)
137      +e = Nat.mod(CV.os2ip(tagged(tag_challenge(), cat(rb, cat(pb, m)))), n(one))
138      sign_fin(one, pb, m, cat(rb, bytes32(FS.madd(n(one), k, FS.mmul(n(one), e, d)))))