<p>ECDSA_do_sign() does not allow specifying the nonce. You can use ECDSA_do_sign_ex(), which needs extra arguments for (k*G).x and 1/k instead.</p>
<p>Bitcoin master recently switched to the libsecp256k1 library for signing, which always needs the nonce passed explicitly, and does not require precomputation of the x coordinate and inverse. See the code in Bitcoin Core for signing: <a href="https://github.com/bitcoin/bitcoin/blob/0a1d03ca5265293e6419b0ffb68d277da6b1d9a0/src/key.cpp#L75-L92" rel="nofollow noreferrer">https://github.com/bitcoin/bitcoin/blob/0a1d03ca5265293e6419b0ffb68d277da6b1d9a0/src/key.cpp#L75-L92</a></p>
<p>Disclaimer: I'm the author of libsecp256k1.</p>
<p>Edit: this answer is now outdated. libsecp256k1 now computes the nonce automatically using a nonce function. The default nonce function is RFC6979-based. It is no longer possible to specify the nonce directly, as this is dangerous practice.</p>

CC BY-SA 3.0
2014-12-11T00:36:28.310Z
Can you show (or give a link to) an example using that library to sign with a given nonce? Thanks!
morsecoder
CC BY-SA 3.0
2014-12-11T00:56:51.883Z
Updated the post.
Pieter Wuille
CC BY-SA 4.0
2014-12-11T00:29:07.813Z
2021-12-11T22:36:54.873Z
2021-12-11T22:36:54.873Z
Pieter Wuille
<p>Below is the <code>CECKey::Sign()</code> code (v0.9.3).</p>

<pre><code>bool Sign(const uint256 &amp;hash, std::vector&lt;unsigned char&gt;&amp; vchSig) {
    vchSig.clear();
    ECDSA_SIG *sig = ECDSA_do_sign((unsigned char*)&amp;hash, sizeof(hash), pkey);
    if (sig == NULL)
        return false;
    BN_CTX *ctx = BN_CTX_new();
    BN_CTX_start(ctx);
    const EC_GROUP *group = EC_KEY_get0_group(pkey);
    BIGNUM *order = BN_CTX_get(ctx);
    BIGNUM *halforder = BN_CTX_get(ctx);
    EC_GROUP_get_order(group, order, ctx);
    BN_rshift1(halforder, order);
    if (BN_cmp(sig-&gt;s, halforder) &gt; 0) {
        // enforce low S values, by negating the value (modulo the order) if above order/2.
        BN_sub(sig-&gt;s, order, sig-&gt;s);
    }
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    unsigned int nSize = ECDSA_size(pkey);
    vchSig.resize(nSize); // Make sure it is big enough
    unsigned char *pos = &amp;vchSig[0];
    nSize = i2d_ECDSA_SIG(sig, &amp;pos);
    ECDSA_SIG_free(sig);
    vchSig.resize(nSize); // Shrink to fit actual size
    return true;
}
</code></pre>

<p>How could I specify which nonce is used in the <code>ECDSA_do_sign()</code>? By nonce, I am referring to the <code>k</code> value described here: <a href="http://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow">http://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm</a>. </p>

CC BY-SA 3.0
2014-12-08T15:54:51.930Z
At a guess, just looking at the code you pasted, the magic is in `ECDSA_do_sign()`.  I believe that 0.9.3 does its signing through OpenSSL, so you may have to do a bunch of digging.  You may also want to look at the code in the master branch---I think it currently does deterministic nonce generation using Pieter Wuille's libsecp256k1.
David A. Harding
CC BY-SA 3.0
2014-12-11T23:46:59.117Z
If you're going to use your own `k`, I urge you and others to use [RFC6979](http://tools.ietf.org/rfc/rfc6979.txt).
Chuck Batson
<bitcoin-core-development><signature>
How to specify ECDSA nonce used in bitcoin signing code?
morsecoder
# How to specify ECDSA nonce used in bitcoin signing code?

(Asked by: username_0 on 2014-12-08)

Below is the `CECKey::Sign()` code (v0.9.3).

```
bool Sign(const uint256 &hash, std::vector<unsigned char>& vchSig) {
    vchSig.clear();
    ECDSA_SIG *sig = ECDSA_do_sign((unsigned char*)&hash, sizeof(hash), pkey);
    if (sig == NULL)
        return false;
    BN_CTX *ctx = BN_CTX_new();
    BN_CTX_start(ctx);
    const EC_GROUP *group = EC_KEY_get0_group(pkey);
    BIGNUM *order = BN_CTX_get(ctx);
    BIGNUM *halforder = BN_CTX_get(ctx);
    EC_GROUP_get_order(group, order, ctx);
    BN_rshift1(halforder, order);
    if (BN_cmp(sig->s, halforder) > 0) {
        // enforce low S values, by negating the value (modulo the order) if above order/2.
        BN_sub(sig->s, order, sig->s);
    }
    BN_CTX_end(ctx);
    BN_CTX_free(ctx);
    unsigned int nSize = ECDSA_size(pkey);
    vchSig.resize(nSize); // Make sure it is big enough
    unsigned char *pos = &vchSig[0];
    nSize = i2d_ECDSA_SIG(sig, &pos);
    ECDSA_SIG_free(sig);
    vchSig.resize(nSize); // Shrink to fit actual size
    return true;
}

```

How could I specify which nonce is used in the `ECDSA_do_sign()`? By nonce, I am referring to the `k` value described here: <http://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm>.

**Tags:** bitcoin-core-development, signature

> **Comments:**
> **username_1**: At a guess, just looking at the code you pasted, the magic is in `ECDSA_do_sign()`.  I believe that 0.9.3 does its signing through OpenSSL, so you may have to do a bunch of digging.  You may also want to look at the code in the master branch---I think it currently does deterministic nonce generation using username_3 username_3's libsecp256k1.  
> **username_2**: If you're going to use your own `k`, I urge you and others to use [RFC6979](http://tools.ietf.org/rfc/rfc6979.txt).  

---

## 1 answers

### Answer by username_3 on 2014-12-11. Score: 7 | Accepted answer

ECDSA\_do\_sign() does not allow specifying the nonce. You can use ECDSA\_do\_sign\_ex(), which needs extra arguments for (k\*G).x and 1/k instead.

Bitcoin master recently switched to the libsecp256k1 library for signing, which always needs the nonce passed explicitly, and does not require precomputation of the x coordinate and inverse. See the code in Bitcoin Core for signing: <https://github.com/bitcoin/bitcoin/blob/0a1d03ca5265293e6419b0ffb68d277da6b1d9a0/src/key.cpp#L75-L92>

Disclaimer: I'm the author of libsecp256k1.

Edit: this answer is now outdated. libsecp256k1 now computes the nonce automatically using a nonce function. The default nonce function is RFC6979-based. It is no longer possible to specify the nonce directly, as this is dangerous practice.

> **Comments:**
> **username_0**: Can you show (or give a link to) an example using that library to sign with a given nonce? Thanks!  
> **username_3**: Updated the post.  

---

