def sign_loop

bend-collections@1.0.0.0 · src/crypto/secp256k1/ecdsa.bend:109

import Base

109# step h: the candidate V; a k outside [1, n - 1], or one giving r = 0 or
110# s = 0 (SEC 1 section 4.1.3 steps 3 and 6), is replaced by the next
111# candidate: K = HMAC_K(V || 0x00), V = HMAC_K(V), V = HMAC_K(V). The loop
112# stops after `fuel` candidates (the chance that even 2 are needed is below
113# 2^-127).
114def sign_loop(fuel: Nat, +z: List<&2, Nat>, +d: List<&2, Nat>, +k: List<&2, U32>, +v: List<&2, U32>, att: Attempt) -> Maybe<&2, Signature>:
115  match fuel att:
116    case 0n ARetry{}: None{}
117    case 0n ADone{sig}: Some{sig}
118    case 1n+f ARetry{}:
119      +k2 = hmac(k, cat(v, [0]))
120      +v3 = hmac(k2, hmac(k2, v))
121      sign_loop(f, z, d, k2, v3, attempt(z, d, v3))
122    case 1n+f ADone{sig}: Some{sig}