Signing

ECDSA signing of message m with private key d:

1. e = SHA-256(m), truncated to ~bit length of n
2. Choose ephemeral k ∈ [1, n-1] (CSPRNG; or RFC 6979 deterministic)
3. R = kG; r = R.x mod n; if r = 0, retry
4. s = k^(-1) (e + r*d) mod n; if s = 0, retry
5. Output (r, s)

The signature is the pair (r, s), each ~32 bytes for secp256k1. Total: ~64 bytes (or DER-encoded ~70-72 bytes).

CRITICAL: k MUST be unique per signature AND unpredictable.

• Reusing k for two messages → reveals d via simple algebra. Sony PS3 was hacked this way.
• Predictable k → recover d via cryptanalysis.

Best practice: RFC 6979 deterministic k = HMAC-derived from (d, m). No RNG needed; reproducible.

Real implementations bracket against k=0 and r=0 by re-deriving with extra entropy — see RFC 6979.