[Docs] [txt|pdf] [draft-pornin-dete...] [Diff1] [Diff2] [Errata]

Errata Exist
Independent Submission                                         T. Pornin
Request for Comments: 6979                                   August 2013
Category: Informational
ISSN: 2070-1721

    Deterministic Usage of the Digital Signature Algorithm (DSA) and
           Elliptic Curve Digital Signature Algorithm (ECDSA)


   This document defines a deterministic digital signature generation
   procedure.  Such signatures are compatible with standard Digital
   Signature Algorithm (DSA) and Elliptic Curve Digital Signature
   Algorithm (ECDSA) digital signatures and can be processed with
   unmodified verifiers, which need not be aware of the procedure
   described therein.  Deterministic signatures retain the cryptographic
   security features associated with digital signatures but can be more
   easily implemented in various environments, since they do not need
   access to a source of high-quality randomness.

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This is a contribution to the RFC Series, independently of any other
   RFC stream.  The RFC Editor has chosen to publish this document at
   its discretion and makes no statement about its value for
   implementation or deployment.  Documents approved for publication by
   the RFC Editor are not a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.

Pornin                        Informational                     [Page 1]

RFC 6979               Deterministic DSA and ECDSA           August 2013

Table of Contents

   1. Introduction ....................................................3
      1.1. Requirements Language ......................................4
   2. DSA and ECDSA Notations .........................................4
      2.1. Key Parameters .............................................5
      2.2. Key Pairs ..................................................5
      2.3. Integer Conversions ........................................6
           2.3.1. Bits and Octets .....................................6
           2.3.2. Bit String to Integer ...............................6
           2.3.3. Integer to Octet String .............................7
           2.3.4. Bit String to Octet String ..........................7
           2.3.5. Usage ...............................................8
      2.4. Signature Generation .......................................8
   3. Deterministic DSA and ECDSA ....................................10
      3.1. Building Blocks ...........................................10
           3.1.1. HMAC ...............................................10
      3.2. Generation of k ...........................................10
      3.3. Alternate Description of the Generation of k ..............12
      3.4. Usage Notes ...............................................13
      3.5. Rationale .................................................13
      3.6. Variants ..................................................14
   4. Security Considerations ........................................15
   5. Intellectual Property Status ...................................17
   6. References .....................................................17
      6.1. Normative References ......................................17
      6.2. Informative References ....................................18
   Appendix A.  Examples .............................................20
     A.1.  Detailed Example ..........................................20
       A.1.1.  Key Pair ..............................................20
       A.1.2.  Generation of k .......................................20
       A.1.3.  Signature .............................................23
     A.2.  Test Vectors ..............................................24
       A.2.1.  DSA, 1024 Bits ........................................25
       A.2.2.  DSA, 2048 Bits ........................................27
       A.2.3.  ECDSA, 192 Bits (Prime Field) .........................29
       A.2.4.  ECDSA, 224 Bits (Prime Field) .........................31
       A.2.5.  ECDSA, 256 Bits (Prime Field) .........................33
       A.2.6.  ECDSA, 384 Bits (Prime Field) .........................35
       A.2.7.  ECDSA, 521 Bits (Prime Field) .........................38
       A.2.8.  ECDSA, 163 Bits (Binary Field, Koblitz Curve) .........42
       A.2.9.  ECDSA, 233 Bits (Binary Field, Koblitz Curve) .........44
       A.2.10. ECDSA, 283 Bits (Binary Field, Koblitz Curve) .........46
       A.2.11. ECDSA, 409 Bits (Binary Field, Koblitz Curve) .........49
       A.2.12. ECDSA, 571 Bits (Binary Field, Koblitz Curve) .........52
       A.2.13. ECDSA, 163 Bits (Binary Field, Pseudorandom Curve) ....56
       A.2.14. ECDSA, 233 Bits (Binary Field, Pseudorandom Curve) ....58
       A.2.15. ECDSA, 283 Bits (Binary Field, Pseudorandom Curve) ....60

Pornin                        Informational                     [Page 2]

RFC 6979               Deterministic DSA and ECDSA           August 2013

       A.2.16. ECDSA, 409 Bits (Binary Field, Pseudorandom Curve) ....63
       A.2.17. ECDSA, 571 Bits (Binary Field, Pseudorandom Curve) ....66
     A.3.  Sample Code ...............................................70

1.  Introduction

   DSA [FIPS-186-4] and ECDSA [X9.62] are two standard digital signature
   schemes.  They provide data integrity and verifiable authenticity in
   various protocols.

   One characteristic of DSA and ECDSA is that they need to produce, for
   each signature generation, a fresh random value (hereafter designated
   as k).  For effective security, k must be chosen randomly and
   uniformly from a set of modular integers, using a cryptographically
   secure process.  Even slight biases in that process may be turned
   into attacks on the signature schemes.

   The need for a cryptographically secure source of randomness proves
   to be a hindrance to deployment of DSA and ECDSA signature schemes in
   some architectures in which secure random number generation is
   challenging, in particular, embedded systems such as smartcards.  In
   those systems, the RSA signature algorithm, used as specified in
   Public-Key Cryptography Standards (PKCS) #1 [RFC3447] (with "type 1"
   padding, not the Probabilistic Signature Scheme (PSS)) and ISO 9796-2
   [ISO-9796-2], is often preferred, even though it is computationally
   more expensive, because RSA (with such padding schemes) is
   deterministic and thus does not require a source of randomness.

   The randomized nature of DSA and ECDSA also makes implementations
   harder to test.  Automatic tests cannot reliably detect whether the
   implementation uses a source of randomness of high enough quality.
   This makes the implementation process more vulnerable to catastrophic
   failures, often discovered after the system has been deployed and
   successfully attacked.

   It is possible to turn DSA and ECDSA into deterministic schemes by
   using a deterministic process for generating the "random" value k.
   That process must fulfill some cryptographic characteristics in order
   to maintain the properties of verifiability and unforgeability
   expected from signature schemes; namely, for whoever does not know
   the signature private key, the mapping from input messages to the
   corresponding k values must be computationally indistinguishable from
   what a randomly and uniformly chosen function (from the set of
   messages to the set of possible k values) would return.

Pornin                        Informational                     [Page 3]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   This document describes such a procedure.  It has the following

   o  Produced signatures remain fully compatible with plain DSA and
      ECDSA.  Entities that verify the signatures need not be changed or
      even be aware of the process used to generate k.

   o  Key pair generation is not altered.  Existing private keys can be
      used with deterministic DSA and ECDSA.

   o  Using deterministic DSA and ECDSA implies no extra storage
      requirement of any secret or public value.

   o  Deterministic DSA and ECDSA can be applied over the same inputs as
      plain DSA and ECDSA, namely a hash value computed over the message
      that is to be signed, with a cryptographically secure hash

   Some relatively arbitrary choices were taken in the definition of
   deterministic (EC)DSA as specified in this document; this was done in
   order to make it as universally applicable as possible, so as to
   maximize usefulness of included test vectors.  See Section 3.6 for a
   discussion of some possible variants.

   It shall be noted that key pair generation still requires a source of
   randomness.  In embedded systems where quality of randomness is an
   issue, it can often be arranged that key pair generation occurs
   within more controlled conditions (e.g., during a special smartcard
   initialization procedure or under physical control of sworn agents)
   or the key might even be generated elsewhere and imported in the
   device.  Deterministic DSA and ECDSA only deal with the need for
   randomness at the time of signature generation.

1.1.  Requirements Language

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   document are to be interpreted as described in RFC 2119 [RFC2119].

2.  DSA and ECDSA Notations

   In this section, we succinctly describe DSA and ECDSA and define our
   notations.  The complete specifications for DSA and ECDSA can be
   found in [FIPS-186-4] and [X9.62], respectively.

Pornin                        Informational                     [Page 4]

RFC 6979               Deterministic DSA and ECDSA           August 2013

2.1.  Key Parameters

   DSA and ECDSA work over a large group of prime size, in which the
   group operation is easy to compute, but the discrete logarithm is
   computationally infeasible with existing and foreseeable technology.
   The definition of the group is called the "key parameters".  Key
   parameters may be shared between different key pairs with no ill
   effect on security; this is the usual case with ECDSA in particular.

   DSA uses the following key parameters:

   p    a large prime number (at least 1024 bits)

   q    a sufficiently large prime number (at least 160 bits) that is
        also a divisor of p-1

   g    a generator for the multiplicative subgroup of order q of
        integers modulo p

   The group on which DSA will be computed consists of the values
   'g^j mod p', where '^' denotes exponentiation and j ranges from 0 to
   q-1 (inclusive).  The size of the group is q.

   ECDSA uses the following key parameters:

   E    an elliptic curve, defined over a given finite field

   q    a sufficiently large prime number (at least 160 bits) that is a
        divisor of the curve order

   G    a point of E, of order q

   The group on which ECDSA will be computed consists of the curve
   points jG (multiplication of point G by integer j) where j ranges
   from 0 to q-1.  G is such that qG = 0 (the "point at infinity" on the
   curve E).  The size of the group is q.  Note that these notations
   slightly differ from those described in [X9.62]; we use them in order
   to match those used for DSA.

2.2.  Key Pairs

   A DSA or ECDSA private key is an integer x taken modulo q.  The
   relevant standards prescribe that x shall not be 0; hence, x is an
   integer in the range [1, q-1].

Pornin                        Informational                     [Page 5]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   A DSA or ECDSA public key is computed from the private key x and the
   key parameters:

   o  For DSA, the public key is the integer: y = g^x mod p

   o  For ECDSA, the public key is the curve point: U = xG

2.3.  Integer Conversions

   Let qlen be the binary length of q.  qlen is the smallest integer
   such that q is less than 2^qlen.  This is the size of the binary
   representation of q without a sign bit (note that q, being a big
   prime, is odd, thus avoiding any ambiguity about the length of any
   integer equal to a power of 2).  We define five conversion functions,
   which work on strings of bits, octets, and integers modulo q.  qlen
   is the main parameter for these conversions.

   In the following subsections, we use two other lengths, called blen
   and rlen.  rlen is equal to qlen, rounded up to the next multiple of
   8 (if qlen is already a multiple of 8, then rlen equals qlen;
   otherwise, rlen is slightly larger, up to qlen+7).  Note that rlen is
   unrelated to the value r, the first half of a generated signature.
   blen is the length (in bits) of an input sequence of bits and may
   vary between calls.  blen may be smaller than, equal to, or larger
   than qlen.

2.3.1.  Bits and Octets

   Formally, all operations are defined on sequences of bits.  A
   sequence is ordered; the first bit is said to be leftmost, while the
   last bit is rightmost.

   On most software systems, bits are grouped into octets (sequences of
   eight bits).  Binary data, e.g., the output of a hash function, is
   available as a sequence of octets.  Whenever applicable, we consider
   that bits within an octet are ordered from most significant to least
   significant: the first (leftmost) bit within an octet has numerical
   value 128, while the last (rightmost) has numerical value 1.

2.3.2.  Bit String to Integer

   The bits2int transform takes as input a sequence of blen bits and
   outputs a non-negative integer that is less than 2^qlen.  It consists
   of the following steps:

Pornin                        Informational                     [Page 6]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   1.  The sequence is first truncated or expanded to length qlen:

       *  if qlen < blen, then the qlen leftmost bits are kept, and
          subsequent bits are discarded;

       *  otherwise, qlen-blen bits (of value zero) are added to the
          left of the sequence (i.e., before the input bits in the
          sequence order).

   2.  The resulting sequence is then converted to an integer value
       using the big-endian convention: if input bits are called b_0
       (leftmost) to b_(qlen-1) (rightmost), then the resulting value

          b_0*2^(qlen-1) + b_1*2^(qlen-2) + ... + b_(qlen-1)*2^0

   The bits2int transform can also be described in the following way:
   the input bit sequence (of length blen) is transformed into an
   integer using the big-endian convention.  Then, if blen is greater
   than qlen, the resulting integer is divided by two to the power
   blen-qlen (Euclidian division: the remainder is discarded); in many
   software implementations of arithmetics on big integers, that
   division is equivalent to a "right shift" by blen-qlen bits.

2.3.3.  Integer to Octet String

   An integer value x less than q (and, in particular, a value that has
   been taken modulo q) can be converted into a sequence of rlen bits,
   where rlen = 8*ceil(qlen/8).  This is the sequence of bits obtained
   by big-endian encoding.  In other words, the sequence bits x_i (for i
   ranging from 0 to rlen-1) are such that:

      x = x_0*2^(rlen-1) + x_1*2^(rlen-2) + ... + x_(rlen-1)

   We call this transform int2octets.  Since rlen is a multiple of 8
   (the smallest multiple of 8 that is not smaller than qlen), then the
   resulting sequence of bits is also a sequence of octets, hence the

2.3.4.  Bit String to Octet String

   The bits2octets transform takes as input a sequence of blen bits and
   outputs a sequence of rlen bits.  It consists of the following steps:

   1.  The input sequence b is converted into an integer value z1
       through the bits2int transform:

          z1 = bits2int(b)

Pornin                        Informational                     [Page 7]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   2.  z1 is reduced modulo q, yielding z2 (an integer between 0 and
       q-1, inclusive):

          z2 = z1 mod q

       Note that since z1 is less than 2^qlen, that modular reduction
       can be implemented with a simple conditional subtraction:
       z2 = z1-q if that value is non-negative; otherwise, z2 = z1.

   3.  z2 is transformed into a sequence of octets (a sequence of rlen
       bits) by applying int2octets.

2.3.5.  Usage

   It is worth noting that int2octets is not the reverse of bits2int,
   even for input sequences of length qlen: int2octets will add some
   bits on the left, while bits2int will discard some bits on the right.
   int2octets is the reverse of bits2int only when qlen is a multiple of
   8 and bit sequences already have length qlen.

   bits2int is used during signature generation and verification in
   standard DSA and ECDSA to transform a hash value (computed over the
   input message) into an integer modulo q.  That is, the integer
   obtained through bits2int is further reduced modulo q; since that
   integer is less than 2^qlen, that reduction can be performed with at
   most one subtraction.

   int2octets is defined under the name "Integer-to-OctetString" in
   Section 2.3.7 of SEC 1 [SEC1].  It is used in the specification of
   the encoding of an ECDSA private key (x) within an ASN.1-based

   bits2octets is not used in standard DSA or ECDSA.  We will use it in
   the specification of deterministic (EC)DSA.

2.4.  Signature Generation

   Signature generation uses a cryptographic hash function H and an
   input message m.  The message is first processed by H, yielding the
   value H(m), which is a sequence of bits of length hlen.  Normally, H
   is chosen such that its output length hlen is roughly equal to qlen,
   since the overall security of the signature scheme will depend on the
   smallest of hlen and qlen; however, the relevant standards support
   all combinations of hlen and qlen.

Pornin                        Informational                     [Page 8]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   The following steps are then applied:

   1.  H(m) is transformed into an integer modulo q using the bits2int
       transform and an extra modular reduction:

          h = bits2int(H(m)) mod q

       As was noted in the description of bits2octets, the extra modular
       reduction is no more than a conditional subtraction.

   2.  A random value modulo q, dubbed k, is generated.  That value
       shall not be 0; hence, it lies in the [1, q-1] range.  Most of
       the remainder of this document will revolve around the process
       used to generate k.  In plain DSA or ECDSA, k should be selected
       through a random selection that chooses a value among the q-1
       possible values with uniform probability.

   3.  A value r (modulo q) is computed from k and the key parameters:

       *  For DSA:

             r = g^k mod p mod q

          (The exponentiation is performed modulo p, yielding a number
          between 0 and p-1, which is then further reduced modulo q.)

       *  For ECDSA: the point kG is computed; its X coordinate (a
          member of the field over which E is defined) is converted to
          an integer, which is reduced modulo q, yielding r.

       If r turns out to be zero, a new k should be selected and r
       computed again (this is an utterly improbable occurrence).

   4.  The value s (modulo q) is computed:

          s = (h+x*r)/k mod q

       The pair (r, s) is the signature.  How a signature is to be
       encoded is not covered by the DSA and ECDSA standards themselves;
       a common way is to use a DER-encoded ASN.1 structure (a SEQUENCE
       of two INTEGERs, for r and s, in that order).

Pornin                        Informational                     [Page 9]

RFC 6979               Deterministic DSA and ECDSA           August 2013

3.  Deterministic DSA and ECDSA

   Deterministic (EC)DSA is the process of generating an (EC)DSA
   signature over an input message m by using the standard (EC)DSA
   signature generation process (discussed in the previous section),
   except that the value k, instead of being randomly generated, is
   obtained through the process described in this section.

   We use the notations described in Section 2.

3.1.  Building Blocks

3.1.1.  HMAC

   HMAC [RFC2104] is a construction of a Message Authentication Code
   using a hash function and a secret key.  Here, we use HMAC with the
   same hash function H as the one used to process the input message
   prior to signature generation or verification.

   We denote the process of applying HMAC with key K over data V by:


   which returns a sequence of bits of length hlen (the output length of
   the underlying hash function H).

3.2.  Generation of k

   Given the input message m, the following process is applied:

   a.  Process m through the hash function H, yielding:

          h1 = H(m)

       (h1 is a sequence of hlen bits).

   b.  Set:

          V = 0x01 0x01 0x01 ... 0x01

       such that the length of V, in bits, is equal to 8*ceil(hlen/8).
       For instance, on an octet-based system, if H is SHA-256, then V
       is set to a sequence of 32 octets of value 1.  Note that in this
       step and all subsequent steps, we use the same H function as the
       one used in step 'a' to process the input message; this choice
       will be discussed in more detail in Section 3.6.

Pornin                        Informational                    [Page 10]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   c.  Set:

          K = 0x00 0x00 0x00 ... 0x00

       such that the length of K, in bits, is equal to 8*ceil(hlen/8).

   d.  Set:

          K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1))

       where '||' denotes concatenation.  In other words, we compute
       HMAC with key K, over the concatenation of the following, in
       order: the current value of V, a sequence of eight bits of value
       0, the encoding of the (EC)DSA private key x, and the hashed
       message (possibly truncated and extended as specified by the
       bits2octets transform).  The HMAC result is the new value of K.
       Note that the private key x is in the [1, q-1] range, hence a
       proper input for int2octets, yielding rlen bits of output, i.e.,
       an integral number of octets (rlen is a multiple of 8).

   e.  Set:

          V = HMAC_K(V)

   f.  Set:

          K = HMAC_K(V || 0x01 || int2octets(x) || bits2octets(h1))

       Note that the "internal octet" is 0x01 this time.

   g.  Set:

          V = HMAC_K(V)

   h.  Apply the following algorithm until a proper value is found for

       1.  Set T to the empty sequence.  The length of T (in bits) is
           denoted tlen; thus, at that point, tlen = 0.

       2.  While tlen < qlen, do the following:

              V = HMAC_K(V)

              T = T || V

Pornin                        Informational                    [Page 11]

RFC 6979               Deterministic DSA and ECDSA           August 2013

       3.  Compute:

              k = bits2int(T)

           If that value of k is within the [1,q-1] range, and is
           suitable for DSA or ECDSA (i.e., it results in an r value
           that is not 0; see Section 3.4), then the generation of k is
           finished.  The obtained value of k is used in DSA or ECDSA.
           Otherwise, compute:

              K = HMAC_K(V || 0x00)

              V = HMAC_K(V)

           and loop (try to generate a new T, and so on).

   Please note that when k is generated from T, the result of bits2int
   is compared to q, not reduced modulo q.  If the value is not between
   1 and q-1, the process loops.  Performing a simple modular reduction
   would induce biases that would be detrimental to signature security.

3.3.  Alternate Description of the Generation of k

   The process described in the previous section is actually derived
   from the "HMAC_DRBG" pseudorandom number generator, described in
   [SP800-90A] and Annex D of [X9.62].  Using the terminology from
   [SP800-90A], the generation of k can be described as such:

   a.  Instantiate HMAC_DRBG using HMAC parameterized with the same hash
       function H as the one used for processing the message that is to
       be signed.  Instantiation parameters are:

          Set this parameter to any value that the HMAC_DRBG
          implementation will accept, when using H as base hash

          Set this parameter to "false".

          Set this parameter to "Null" (the empty bit sequence).

          Use int2octets(x) as entropy string.

          Use bits2octets(H(m)) as nonce.

Pornin                        Informational                    [Page 12]

RFC 6979               Deterministic DSA and ECDSA           August 2013

       Note that the last two parameters are not parameters to the
       HMAC_DRBG instantiation function per se; instead, those values
       are requested from the internal Get_entropy_input function during
       instantiation.  For deterministic (EC)DSA, we want HMAC_DRBG to
       run with the entropy string and nonce that we specify, without
       accessing an actual entropy source.

   b.  Generate a candidate value for k by requesting qlen bits from
       HMAC_DRBG and converting the resulting bits into an integer with
       the bits2int transform.  Repeat this step until a value is
       obtained, which is non-zero, less than q, and suitable for
       (EC)DSA (see Section 3.4).

   Note that we instantiate a new HMAC_DRBG instance for each signature
   generation process.  There is no "personalization string" and no
   "additional input" when generating bits.  The reseed function of
   HMAC_DRBG is never invoked, neither externally nor as a consequence
   of the internal HMAC_DRBG processing.

   As shown above, we use the encoding of the private key as "entropy
   string" and the hashed message (truncated and expanded by
   bits2octets) as "nonce".  In HMAC_DRBG, the entropy string and nonce
   are simply concatenated into the initial seed; hence, the split
   between "entropy" and "nonce" is quite arbitrary.  Using qlen bits
   for each ought to be compatible with most HMAC_DRBG implementation
   input requirements.

3.4.  Usage Notes

   With DSA or ECDSA, the value k is used to compute the first half of
   the signature, dubbed r (see Section 2.4).  The DSA and ECDSA
   standards mandate that, if r is zero, then a new k should be
   selected.  In that situation, this document specifies that the value
   k is "unsuitable", and the generation process shall keep on looping.

   This occurrence is utterly improbable.  Actually, it would require
   considerable computational effort (similar to breaking preimage
   resistance of the hash function) to find a private key and a message
   that lead to a zero value for r; hitting such a case by pure chance
   is thus deemed implausible, and an attacker cannot force it with
   carefully crafted messages.  In practice, such a code path will not
   be triggered and thus can be implemented with little optimization.

3.5.  Rationale

   The process described in the previous sections mimics the "Approved"
   generation process of k described in Annex D of [X9.62], with the
   "HMAC_DRBG" pseudorandom number generator.  The main difference is

Pornin                        Informational                    [Page 13]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   that we use the concatenation of the private key x and the hashed
   message H(m) as the pseudorandom number generator (PRNG) seed.  If
   using a "security level" of n bits, then HMAC_DRBG should be used
   with seed entropy at least n+64 bits; however, the key x should also
   have been generated with that much entropy, and the length of x is
   qlen, which is at least equal to 2*n and thus larger than n+64 (DSA
   and ECDSA, as specified by the standards, require qlen >= 160).  It
   can then be argued that deterministic ECDSA fulfills the entropy
   requirements of Annex D of [X9.62].

   We use bits2octets(H(m)) instead of H(m) in order to ease
   integration.  Indeed, many existing signature systems offload the
   message hashing; the signature engine (which has access to the
   private key) receives only H(m).  In some applications, where data
   bandwidth is constrained, only the first qlen bits of H(m) are
   transferred to the signature engine, on the basis that the bits2int
   transform will ignore subsequent bits anyway.  Possibly, in some
   systems, the truncated H(m) could be externally reduced modulo q,
   since that is the first thing that (EC)DSA performs on the hashed
   message.  With the definition of bits2octets, deterministic (EC)DSA
   can be applied with the same input.

3.6.  Variants

   Many parts of the specification of deterministic (EC)DSA are quite
   arbitrary.  It is possible to define variants that are NOT
   "deterministic (EC)DSA" but that may nonetheless be useful in some

   o  It is possible to use H(m) directly, instead of bits2octets(H(m)),
      as part of the HMAC input.  As explained in Section 3.5, we use
      bits2octets(H(m)) in order to ease integration into systems that
      already use an (EC)DSA signature engine by sending it an already-
      truncated hash value.  Using the whole H(m) does not introduce any

   o  Additional data may be added to the input of HMAC, concatenated
      after bits2octets(H(m)):

         K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')

      A use case may be a protocol that requires a non-deterministic
      signature algorithm on a system that does not have access to a
      high-quality random source.  It suffices that the additional data
      k' is non-repeating (e.g., a signature counter or a monotonic
      clock) to ensure "random-looking" signatures are
      indistinguishable, in a cryptographic way, from plain (EC)DSA
      signatures.  In [SP800-90A] terminology, k' is the "additional

Pornin                        Informational                    [Page 14]

RFC 6979               Deterministic DSA and ECDSA           August 2013

      input" that can be set as a parameter when generating pseudorandom
      bits.  This variant can be thought of as a "strengthening" of the
      randomness of the source of the additional data k'.

   o  Instead of using x (the private key) as input to HMAC, it is
      possible to use additional secret data, stored along with the
      private key with the same security measures.  The entropy of that
      additional data SHALL be at least n bits, preferably n+64 bits or
      more, where n is the target security level.  Having additional
      secret data may help in formally proving the security of
      derandomization, but it implies an extra storage cost and
      incompatibility with already-generated (EC)DSA private keys.

   o  Similarly, the private key could be a value z, from which both x
      (the "private key" in the plain (EC)DSA sense) and another value
      x', to be used as input to HMAC in the generation of k, would be
      derived through a suitable Pseudorandom Function (PRF) (such as
      HMAC_DRBG).  This would keep private key storage requirements to a
      minimum while providing a more easily proven security, but it
      would impact private key generation and would not be compatible
      with already-generated key pairs.

   o  In this document, we use the same hash function H for processing
      the input message and as a parameter to HMAC.  Two distinct hash
      functions could be used, provided that both are adequately secure.
      The overall security will be limited by the weaker of the two hash
      functions, i.e., the one with the smaller output.  Using a
      specific, constant hash function for HMAC may be useful for
      constrained implementations that accept externally hashed
      messages, regardless of what hash function was used for that, but
      have resources for implementing only one hash function for HMAC.

   The main disadvantage of any variant is that it ceases to be
   verifiable against the test vectors published in this document.

4.  Security Considerations

   Proper implementation and usage of a cryptographic signature
   algorithm require taking into account many parameters.  In
   particular, private key generation, storage, access control, and
   disposal are sensitive operations, which this document does not
   address in any way.  Deterministic (EC)DSA shows how to achieve the
   security characteristics of a standard DSA or ECDSA signature scheme
   while removing the need for a source of strong randomness, or even
   any source of randomness, during signature generation.

Pornin                        Informational                    [Page 15]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   Private key generation, however, absolutely requires such a strongly
   random source.  In situations where deterministic (EC)DSA is to be
   used due to the lack of an appropriate source of randomness, one must
   assume that the private key has been generated externally and
   imported into the signature generation system or was generated in a
   context where randomness was available.  For instance, one can
   imagine a smartcard that generates its private key while still in the
   factory under controlled environmental conditions, but for which
   random data generation cannot be guaranteed once deployed in the
   field, when physically in the hands of potential attackers.

   Both removal of the random source requirement and the ability to test
   an implementation against test vectors enhance security of DSA and
   ECDSA signer implementations, in that they help avoid hard-to-test
   failure conditions.  Deterministic signature schemes may also help in
   other situations, e.g., to avoid spurious duplicates, when the same
   data element is signed several times with the same key: with a
   deterministic signature scheme, the same signature is generated every
   time, making duplicate detection much easier.

   Conversely, lack of randomization may have adverse effects in some
   advanced protocols, e.g., related to anonymity in some voting
   schemes.  As a rule of thumb, deterministic DSA or ECDSA can be used
   in lieu of the genuine DSA or ECDSA, with no additional security
   issues, if the overall protocol would tolerate another deterministic
   signature scheme, in particular RSA as specified in PKCS #1 [RFC3447]
   (with "type 1" padding, not PSS) or ISO 9796-2 [ISO-9796-2].  The
   list of protocols in which deterministic DSA or ECDSA is appropriate
   includes Transport Layer Security (TLS) [RFC5246], the Secure SHell
   (SSH) Protocol [RFC4251], Cryptographic Message Syntax (CMS)
   [RFC5652] and derivatives, X.509 public key infrastructures
   [RFC5280], and many others.

   The construction described in this document is known as a
   "derandomization".  This has been proposed for various signature
   schemes.  Security relies on whether the generation of k is
   indistinguishable from the output of a random oracle.  Roughly
   speaking, HMAC_DRBG is secure in that role as long as HMAC behaves as
   a PRF (Pseudorandom Function).  For details on the security of HMAC
   and HMAC_DRBG, please refer to [H2008] and [B2006].  For a more
   formal treatment of derandomization, see [LN2009].

   One remaining issue with deterministic (EC)DSA, as presented in this
   document, is the "double use" of the private key x, both as the
   private key in the signature generation algorithm itself and as input
   to the HMAC_DRBG-based pseudorandom oracle for producing the k value.
   This requires HMAC_DRBG to keep on being a random oracle, even when

Pornin                        Informational                    [Page 16]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   the public key (which is computed from x) is also known.  Given the
   lack of common structure between HMAC and discrete logarithms, this
   seems a reasonable assumption.

   Side-channel attacks are an important consideration whenever an
   attacker can accurately measure aspects of an implementation such as
   the length of time that it takes to perform a signing operation or
   the power consumed at each point of a signing operation.  The
   determinism of the algorithms described in this note may be useful to
   an attacker in some forms of side-channel attacks, so implementations
   SHOULD use defensive measures to avoid leaking the private key
   through a side channel.

5.  Intellectual Property Status

   To the best of our knowledge, deterministic (EC)DSA is not covered by
   any active patent.  The paper [BDLSY2011] points to two independent
   publications of the idea of derandomization by Barwood and Wigley,
   both in early 1997, and also to a patent application by Naccache,
   M'Raihi, and Levy-dit-Vehel a few months later [NML1997], but the
   application was withdrawn in 2003.  We are not aware of any other
   patent on the subject.

6.  References

6.1.  Normative References

   [FIPS-186-4]  National Institute of Standards and Technology,
                 "Digital Signature Standard (DSS)", Federal Information
                 Processing Standards Publication (FIPS PUB) 186-4,
                 July 2013.

   [RFC2104]     Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
                 Keyed-Hashing for Message Authentication", RFC 2104,
                 February 1997.

   [RFC2119]     Bradner, S., "Key words for use in RFCs to Indicate
                 Requirement Levels", BCP 14, RFC 2119, March 1997.

   [SEC1]        Certicom Research, "SEC 1: Elliptic Curve Cryptography
                 (Version 2.0)", May 2009.

   [SP800-90A]   National Institute of Standards and Technology,
                 "Recommendation for Random Number Generation Using
                 Deterministic Random Bit Generators (Revised)", NIST
                 Special Publication 800-90A, January 2012.

Pornin                        Informational                    [Page 17]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   [X9.62]       American National Standards Institute, "Public Key
                 Cryptography for the Financial Services Industry: The
                 Elliptic Curve Digital Signature Algorithm (ECDSA)",
                 ANSI X9.62-2005, November 2005.

6.2.  Informative References

   [B2006]       Bellare, M., "New Proofs for NMAC and HMAC: Security
                 without Collision-Resistance", Crypto 2006, LNCS 4117,
                 August 2006.

   [BDLSY2011]   Bernstein, D., Duif, N., Lange, T., Schwabe, P., and B.
                 Yang, "High-speed high-security signatures", Cryptology
                 ePrint Archive Report 2011/368, September 2011.

   [FIPS-180-4]  National Institute of Standards and Technology, "Secure
                 Hash Standard (SHS)", Federal Information Processing
                 Standards Publication (FIPS PUB) 180-4, March 2012.

   [H2008]       Hirose, S., "Security Analysis of DRBG Using HMAC in
                 NIST SP 800-90", Information Security Applications
                 (WISA 2008), LNCS 5379, September 2008.

   [ISO-9796-2]  International Organization for Standardization,
                 "Information technology -- Security techniques --
                 Digital signature schemes giving message recovery --
                 Part 2: Integer factorization based mechanisms", ISO/
                 IEC 9796-2:2010, December 2010.

   [LN2009]      Leurent, G. and P. Nguyen, "How Risky is the Random-
                 Oracle Model?", Cryptology ePrint Archive Report 2008/
                 441, July 2009, <http://eprint.iacr.org/2008/441>.

   [NML1997]     Naccache, D., M'Raihi, D., and F. Levy-dit-Vehel,
                 DRAWING", WIPO patent publication WO/1998/051038,
                 May 1998.

   [RFC3447]     Jonsson, J. and B. Kaliski, "Public-Key Cryptography
                 Standards (PKCS) #1: RSA Cryptography Specifications
                 Version 2.1", RFC 3447, February 2003.

   [RFC4251]     Ylonen, T. and C. Lonvick, "The Secure Shell (SSH)
                 Protocol Architecture", RFC 4251, January 2006.

Pornin                        Informational                    [Page 18]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   [RFC5246]     Dierks, T. and E. Rescorla, "The Transport Layer
                 Security (TLS) Protocol Version 1.2", RFC 5246,
                 August 2008.

   [RFC5280]     Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
                 Housley, R., and W. Polk, "Internet X.509 Public Key
                 Infrastructure Certificate and Certificate Revocation
                 List (CRL) Profile", RFC 5280, May 2008.

   [RFC5652]     Housley, R., "Cryptographic Message Syntax (CMS)",
                 STD 70, RFC 5652, September 2009.

Pornin                        Informational                    [Page 19]

RFC 6979               Deterministic DSA and ECDSA           August 2013

Appendix A.  Examples

A.1.  Detailed Example

   We detail here the intermediate values obtained during the generation
   of k on an example message and key.  We use a binary curve because
   that specific curve is standard and has a group order length (qlen)
   that is not a multiple of 8; this illustrates the fine details of how
   conversions are performed between integers and bit sequences.

A.1.1.  Key Pair

   We consider ECDSA on the curve K-163 described in [FIPS-186-4] (also
   known as "ansix9t163k1" in [X9.62]).  The curve is defined over a
   field GF(2^163): field elements are encoded into 163-bit strings.
   The order of the conventional base point is the prime value:

      q = 0x4000000000000000000020108A2E0CC0D99F8A5EF

   which has length qlen = 163 bits.

   Our private key is:

      x = 0x09A4D6792295A7F730FC3F2B49CBC0F62E862272F

   The corresponding public key is the curve point U = xG.  This point
   has two coordinates, which are elements of the field GF(2^163).
   These elements can be converted to integers using the procedure
   described in Section A.5.6 of [X9.62], yielding the two public point

      Ux = 0x79AEE090DB05EC252D5CB4452F356BE198A4FF96F

      Uy = 0x782E29634DDC9A31EF40386E896BAA18B53AFA5A3

A.1.2.  Generation of k

   In this example, we use the hash function SHA-256 [FIPS-180-4].  The
   input message is the UTF-8 encoding of the string "sample" (6 octets,
   i.e., 48 bits).

   The hashed input message h1 = SHA-256(m) is:

      AF 2B DB E1 AA 9B 6E C1 E2 AD E1 D6 94 F4 1F C7
      1A 83 1D 02 68 E9 89 15 62 11 3D 8A 62 AD D1 BF

   (32 octets; each octet value is listed in hexadecimal notation).

Pornin                        Informational                    [Page 20]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   We convert the private key x to a sequence of octets using the
   int2octets transform:

      00 9A 4D 67 92 29 5A 7F 73 0F C3 F2 B4 9C BC 0F
      62 E8 62 27 2F

   Note: Although the specific value of x would numerically fit in 160
   bits, i.e., 20 octets, we still encode x into 21 octets, because the
   encoding length is driven by the length of q, which is 163 bits.

   We also truncate and/or expand the hashed message using bits2octets:

      01 79 5E DF 0D 54 DB 76 0F 15 6D 0D AC 04 C0 32
      2B 3A 20 42 24

   The steps b to g (see Section 3.2) then compute the values for the K
   and V variables.  These variables are sequences of 256 bits (the hash
   function output length, rounded up to a multiple of 8).  We reproduce
   here the successive values:

   V after step b:
      01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01
      01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01

   K after step c:
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

   K after step d:
      09 99 9A 9B FE F9 72 D3 34 69 11 88 3F AD 79 51
      D2 3F 2C 8B 47 F4 20 22 2D 11 71 EE EE AC 5A B8

   V after step e:
      D5 F4 03 0F 75 5E E8 6A A1 0B BA 8C 09 DF 11 4F
      F6 B6 11 1C 23 85 00 D1 3C 73 43 A8 C0 1B EC F7

   K after step f:
      0C F2 FE 96 D5 61 9C 9E F5 3C B7 41 7D 49 D3 7E
      A6 8A 4F FE D0 D7 E6 23 E3 86 89 28 99 11 BD 57

   V after step g:
      78 34 57 C1 CF 31 48 A8 F2 A9 AE 73 ED 47 2F A9
      8E D9 CD 92 5D 8E 96 4C E0 76 4D EF 3F 84 2B 9A

Pornin                        Informational                    [Page 21]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   In step h, we perform the final loop.  Since we use HMAC with SHA-
   256, which produces 256 bits worth of output, and we need only 163
   bits for T, a single HMAC invocation yields the following T:

   T (first try)
      93 05 A4 6D E7 FF 8E B1 07 19 4D EB D3 FD 48 AA
      20 D5 E7 65 6C BE 0E A6 9D 2A 8D 4E 7C 67 31 4A

   which, when converted to an integer with bits2int, yields a first
   candidate for k:

      k1 = 0x4982D236F3FFC758838CA6F5E9FEA455106AF3B2B

   Since that value is greater than q-1, we have to loop.  This first
   entails computing new values for K and V:

   new K
      75 CB 5C 05 B2 A7 8C 3D 81 DF 12 D7 4D 7B E0 A0
      E9 4A B1 98 15 78 1D 4D 8E 29 02 A7 9D 0A 66 99

   new V
      DC B9 CA 12 61 07 A9 C2 7C E7 7B A5 8E A8 71 C8
      C9 12 D8 35 EA DD C3 05 F2 44 5D 88 F6 6C 4C 43

   then a new T:

   T (second try)
      C7 0C 78 60 8A 3B 5B E9 28 9B E9 0E F6 E8 1A 9E
      2C 15 16 D5 75 1D 2F 75 F5 00 33 E4 5F 73 BD EB

   and a new candidate for k:

      k2 = 0x63863C30451DADF4944DF4877B740D4F160A8B6AB

   Since k2 is also greater than q-1, we loop again:

   new K (2)
      0A 5A 64 B9 9C 05 95 20 10 36 86 CB 6F 36 BC FC
      A7 88 EB 3B CF 69 BA 66 A5 BB 08 0B 05 93 BA 53

   new V (2)
      0B 3B 19 68 11 B1 9F 6C 6F 72 9C 43 F3 5B CF 0D
      FD 72 5F 17 CA 34 30 E8 72 14 53 E5 55 50 A1 8F

   T (third try)
      47 5E 80 E9 92 14 05 67 FC C3 A5 0D AB 90 FE 84
      BC D7 BB 03 63 8E 9C 46 56 A0 6F 37 F6 50 8A 7C

Pornin                        Informational                    [Page 22]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   and we finally get an acceptable value for k:

      k = 0x23AF4074C90A02B3FE61D286D5C87F425E6BDD81B

A.1.3.  Signature

   With our private key and the value of k that we just generated, we
   can now compute the signature using the standard ECDSA mechanisms.
   First, the point kG is computed, and the X coordinate of that point
   is converted to an integer and then reduced modulo q, yielding the
   first signature half:

      r = 0x113A63990598A3828C407C0F4D2438D990DF99A7F

   which we use, together with x (the private key), k (which we computed
   above), and h = bits2int(h1), to compute the second signature half:

      s = 0x1313A2E03F5412DDB296A22E2C455335545672D9F

   An ECDSA signature is a pair of integers.  In many protocols that
   require a signature to be a sequence of bits (or octets), it is
   customary to encode the signature as an ASN.1 SEQUENCE of two INTEGER
   values, with DER rules.  This results in the following 48-octet

      30 2E 02 15 01 13 A6 39 90 59 8A 38 28 C4 07 C0
      F4 D2 43 8D 99 0D F9 9A 7F 02 15 01 31 3A 2E 03
      F5 41 2D DB 29 6A 22 E2 C4 55 33 55 45 67 2D 9F

Pornin                        Informational                    [Page 23]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.  Test Vectors

   In the following sections, we give test vectors for various key sizes
   and hash functions, both for DSA and ECDSA.

   All numbers are given in hexadecimal notation.  Each signature
   consists of two integers, named r and s; many implementations will
   encode those integers into a single ASN.1 structure or with some
   other encoding convention, which is outside of the scope of this
   document.  We also show the k value used internally.

   For every key, we list ten signatures, corresponding to two distinct
   input messages, and five of the SHA [FIPS-180-4] functions: SHA-1,
   SHA-224, SHA-256, SHA-384, and SHA-512.  The two input messages are
   the UTF-8 encoding of the strings "sample" and "test" (without the
   quotes), of length 48 and 32 bits, respectively.

   The ECDSA examples use the standard curves described in [FIPS-186-4].

Pornin                        Informational                    [Page 24]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.1.  DSA, 1024 Bits

   Key pair:

   key parameters:

   p = 86F5CA03DCFEB225063FF830A0C769B9DD9D6153AD91D7CE27F787C43278B447

   q = 996F967F6C8E388D9E28D01E205FBA957A5698B1

   g = 07B0F92546150B62514BB771E2A0C0CE387F03BDA6C56B505209FF25FD3C133D

   private key:

   x = 411602CB19A6CCC34494D79D98EF1E7ED5AF25F7

   public key:

   y = 5DF5E01DED31D0297E274E1691C192FE5868FEF9E19A84776454B100CF16F653


   With SHA-1, message = "sample":
   k = 7BDB6B0FF756E1BB5D53583EF979082F9AD5BD5B
   r = 2E1A0C2562B2912CAAF89186FB0F42001585DA55
   s = 29EFB6B0AFF2D7A68EB70CA313022253B9A88DF5

   With SHA-224, message = "sample":
   k = 562097C06782D60C3037BA7BE104774344687649
   r = 4BC3B686AEA70145856814A6F1BB53346F02101E
   s = 410697B92295D994D21EDD2F4ADA85566F6F94C1

   With SHA-256, message = "sample":
   k = 519BA0546D0C39202A7D34D7DFA5E760B318BCFB
   r = 81F2F5850BE5BC123C43F71A3033E9384611C545
   s = 4CDD914B65EB6C66A8AAAD27299BEE6B035F5E89

Pornin                        Informational                    [Page 25]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-384, message = "sample":
   k = 95897CD7BBB944AA932DBC579C1C09EB6FCFC595
   r = 07F2108557EE0E3921BC1774F1CA9B410B4CE65A
   s = 54DF70456C86FAC10FAB47C1949AB83F2C6F7595

   With SHA-512, message = "sample":
   k = 09ECE7CA27D0F5A4DD4E556C9DF1D21D28104F8B
   r = 16C3491F9B8C3FBBDD5E7A7B667057F0D8EE8E1B
   s = 02C36A127A7B89EDBB72E4FFBC71DABC7D4FC69C

   With SHA-1, message = "test":
   k = 5C842DF4F9E344EE09F056838B42C7A17F4A6433
   r = 42AB2052FD43E123F0607F115052A67DCD9C5C77
   s = 183916B0230D45B9931491D4C6B0BD2FB4AAF088

   With SHA-224, message = "test":
   k = 4598B8EFC1A53BC8AECD58D1ABBB0C0C71E67297
   r = 6868E9964E36C1689F6037F91F28D5F2C30610F2
   s = 49CEC3ACDC83018C5BD2674ECAAD35B8CD22940F

   With SHA-256, message = "test":
   k = 5A67592E8128E03A417B0484410FB72C0B630E1A
   r = 22518C127299B0F6FDC9872B282B9E70D0790812
   s = 6837EC18F150D55DE95B5E29BE7AF5D01E4FE160

   With SHA-384, message = "test":
   k = 220156B761F6CA5E6C9F1B9CF9C24BE25F98CD89
   r = 854CF929B58D73C3CBFDC421E8D5430CD6DB5E66
   s = 91D0E0F53E22F898D158380676A871A157CDA622

   With SHA-512, message = "test":
   k = 65D2C2EEB175E370F28C75BFCDC028D22C7DBE9C
   r = 8EA47E475BA8AC6F2D821DA3BD212D11A3DEB9A0
   s = 7C670C7AD72B6C050C109E1790008097125433E8

Pornin                        Informational                    [Page 26]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.2.  DSA, 2048 Bits

   Key pair:

   key parameters:

   p = 9DB6FB5951B66BB6FE1E140F1D2CE5502374161FD6538DF1648218642F0B5C48

   q = F2C3119374CE76C9356990B465374A17F23F9ED35089BD969F61C6DDE9998C1F

   g = 5C7FF6B06F8F143FE8288433493E4769C4D988ACE5BE25A0E24809670716C613

   private key:

   x = 69C7548C21D0DFEA6B9A51C9EAD4E27C33D3B3F180316E5BCAB92C933F0E4DBC

   public key:

   y = 667098C654426C78D7F8201EAC6C203EF030D43605032C2F1FA937E5237DBD94


   With SHA-1, message = "sample":
   k = 888FA6F7738A41BDC9846466ABDB8174C0338250AE50CE955CA16230F9CBD53E
   r = 3A1B2DBD7489D6ED7E608FD036C83AF396E290DBD602408E8677DAABD6E7445A
   s = D26FCBA19FA3E3058FFC02CA1596CDBB6E0D20CB37B06054F7E36DED0CDBBCCF

Pornin                        Informational                    [Page 27]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-224, message = "sample":
   k = BC372967702082E1AA4FCE892209F71AE4AD25A6DFD869334E6F153BD0C4D806
   r = DC9F4DEADA8D8FF588E98FED0AB690FFCE858DC8C79376450EB6B76C24537E2C
   s = A65A9C3BC7BABE286B195D5DA68616DA8D47FA0097F36DD19F517327DC848CEC

   With SHA-256, message = "sample":
   k = 8926A27C40484216F052F4427CFD5647338B7B3939BC6573AF4333569D597C52
   r = EACE8BDBBE353C432A795D9EC556C6D021F7A03F42C36E9BC87E4AC7932CC809
   s = 7081E175455F9247B812B74583E9E94F9EA79BD640DC962533B0680793A38D53

   With SHA-384, message = "sample":
   k = C345D5AB3DA0A5BCB7EC8F8FB7A7E96069E03B206371EF7D83E39068EC564920
   r = B2DA945E91858834FD9BF616EBAC151EDBC4B45D27D0DD4A7F6A22739F45C00B
   s = 19048B63D9FD6BCA1D9BAE3664E1BCB97F7276C306130969F63F38FA8319021B

   With SHA-512, message = "sample":
   k = 5A12994431785485B3F5F067221517791B85A597B7A9436995C89ED0374668FC
   r = 2016ED092DC5FB669B8EFB3D1F31A91EECB199879BE0CF78F02BA062CB4C942E
   s = D0C76F84B5F091E141572A639A4FB8C230807EEA7D55C8A154A224400AFF2351

   With SHA-1, message = "test":
   k = 6EEA486F9D41A037B2C640BC5645694FF8FF4B98D066A25F76BE641CCB24BA4F
   r = C18270A93CFC6063F57A4DFA86024F700D980E4CF4E2CB65A504397273D98EA0
   s = 414F22E5F31A8B6D33295C7539C1C1BA3A6160D7D68D50AC0D3A5BEAC2884FAA

   With SHA-224, message = "test":
   k = 06BD4C05ED74719106223BE33F2D95DA6B3B541DAD7BFBD7AC508213B6DA6670
   r = 272ABA31572F6CC55E30BF616B7A265312018DD325BE031BE0CC82AA17870EA3
   s = E9CC286A52CCE201586722D36D1E917EB96A4EBDB47932F9576AC645B3A60806

   With SHA-256, message = "test":
   k = 1D6CE6DDA1C5D37307839CD03AB0A5CBB18E60D800937D67DFB4479AAC8DEAD7
   r = 8190012A1969F9957D56FCCAAD223186F423398D58EF5B3CEFD5A4146A4476F0
   s = 7452A53F7075D417B4B013B278D1BB8BBD21863F5E7B1CEE679CF2188E1AB19E

   With SHA-384, message = "test":
   k = 206E61F73DBE1B2DC8BE736B22B079E9DACD974DB00EEBBC5B64CAD39CF9F91C
   r = 239E66DDBE8F8C230A3D071D601B6FFBDFB5901F94D444C6AF56F732BEB954BE
   s = 6BD737513D5E72FE85D1C750E0F73921FE299B945AAD1C802F15C26A43D34961

   With SHA-512, message = "test":
   k = AFF1651E4CD6036D57AA8B2A05CCF1A9D5A40166340ECBBDC55BE10B568AA0AA
   r = 89EC4BB1400ECCFF8E7D9AA515CD1DE7803F2DAFF09693EE7FD1353E90A68307
   s = C9F0BDABCC0D880BB137A994CC7F3980CE91CC10FAF529FC46565B15CEA854E1

Pornin                        Informational                    [Page 28]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.3.  ECDSA, 192 Bits (Prime Field)

   Key pair:

   curve: NIST P-192

   (qlen = 192 bits)

   private key:

   x = 6FAB034934E4C0FC9AE67F5B5659A9D7D1FEFD187EE09FD4

   public key: U = xG

   Ux = AC2C77F529F91689FEA0EA5EFEC7F210D8EEA0B9E047ED56

   Uy = 3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43


   With SHA-1, message = "sample":
   k = 37D7CA00D2C7B0E5E412AC03BD44BA837FDD5B28CD3B0021
   r = 98C6BD12B23EAF5E2A2045132086BE3EB8EBD62ABF6698FF
   s = 57A22B07DEA9530F8DE9471B1DC6624472E8E2844BC25B64

   With SHA-224, message = "sample":
   k = 4381526B3FC1E7128F202E194505592F01D5FF4C5AF015D8
   r = A1F00DAD97AEEC91C95585F36200C65F3C01812AA60378F5
   s = E07EC1304C7C6C9DEBBE980B9692668F81D4DE7922A0F97A

   With SHA-256, message = "sample":
   k = 32B1B6D7D42A05CB449065727A84804FB1A3E34D8F261496
   r = 4B0B8CE98A92866A2820E20AA6B75B56382E0F9BFD5ECB55
   s = CCDB006926EA9565CBADC840829D8C384E06DE1F1E381B85

   With SHA-384, message = "sample":
   k = 4730005C4FCB01834C063A7B6760096DBE284B8252EF4311
   r = DA63BF0B9ABCF948FBB1E9167F136145F7A20426DCC287D5
   s = C3AA2C960972BD7A2003A57E1C4C77F0578F8AE95E31EC5E

   With SHA-512, message = "sample":
   k = A2AC7AB055E4F20692D49209544C203A7D1F2C0BFBC75DB1
   r = 4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8
   s = 3F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67

Pornin                        Informational                    [Page 29]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = D9CF9C3D3297D3260773A1DA7418DB5537AB8DD93DE7FA25
   r = 0F2141A0EBBC44D2E1AF90A50EBCFCE5E197B3B7D4DE036D
   s = EB18BC9E1F3D7387500CB99CF5F7C157070A8961E38700B7

   With SHA-224, message = "test":
   k = F5DC805F76EF851800700CCE82E7B98D8911B7D510059FBE
   r = 6945A1C1D1B2206B8145548F633BB61CEF04891BAF26ED34
   s = B7FB7FDFC339C0B9BD61A9F5A8EAF9BE58FC5CBA2CB15293

   With SHA-256, message = "test":
   k = 5C4CE89CF56D9E7C77C8585339B006B97B5F0680B4306C6C
   r = 3A718BD8B4926C3B52EE6BBE67EF79B18CB6EB62B1AD97AE
   s = 5662E6848A4A19B1F1AE2F72ACD4B8BBE50F1EAC65D9124F

   With SHA-384, message = "test":
   k = 5AFEFB5D3393261B828DB6C91FBC68C230727B030C975693
   r = B234B60B4DB75A733E19280A7A6034BD6B1EE88AF5332367
   s = 7994090B2D59BB782BE57E74A44C9A1C700413F8ABEFE77A

   With SHA-512, message = "test":
   k = 0758753A5254759C7CFBAD2E2D9B0792EEE44136C9480527
   r = FE4F4AE86A58B6507946715934FE2D8FF9D95B6B098FE739
   s = 74CF5605C98FBA0E1EF34D4B5A1577A7DCF59457CAE52290

Pornin                        Informational                    [Page 30]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.4.  ECDSA, 224 Bits (Prime Field)

   Key pair:

   curve: NIST P-224

   (qlen = 224 bits)

   private key:

   x = F220266E1105BFE3083E03EC7A3A654651F45E37167E88600BF257C1

   public key: U = xG

   Ux = 00CF08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C

   Uy = EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A


   With SHA-1, message = "sample":
   k = 7EEFADD91110D8DE6C2C470831387C50D3357F7F4D477054B8B426BC
   r = 22226F9D40A96E19C4A301CE5B74B115303C0F3A4FD30FC257FB57AC
   s = 66D1CDD83E3AF75605DD6E2FEFF196D30AA7ED7A2EDF7AF475403D69

   With SHA-224, message = "sample":
   k = C1D1F2F10881088301880506805FEB4825FE09ACB6816C36991AA06D
   r = 1CDFE6662DDE1E4A1EC4CDEDF6A1F5A2FB7FBD9145C12113E6ABFD3E
   s = A6694FD7718A21053F225D3F46197CA699D45006C06F871808F43EBC

   With SHA-256, message = "sample":
   k = AD3029E0278F80643DE33917CE6908C70A8FF50A411F06E41DEDFCDC
   r = 61AA3DA010E8E8406C656BC477A7A7189895E7E840CDFE8FF42307BA
   s = BC814050DAB5D23770879494F9E0A680DC1AF7161991BDE692B10101

   With SHA-384, message = "sample":
   k = 52B40F5A9D3D13040F494E83D3906C6079F29981035C7BD51E5CAC40
   r = 0B115E5E36F0F9EC81F1325A5952878D745E19D7BB3EABFABA77E953
   s = 830F34CCDFE826CCFDC81EB4129772E20E122348A2BBD889A1B1AF1D

   With SHA-512, message = "sample":
   k = 9DB103FFEDEDF9CFDBA05184F925400C1653B8501BAB89CEA0FBEC14
   r = 074BD1D979D5F32BF958DDC61E4FB4872ADCAFEB2256497CDAC30397
   s = A4CECA196C3D5A1FF31027B33185DC8EE43F288B21AB342E5D8EB084

Pornin                        Informational                    [Page 31]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 2519178F82C3F0E4F87ED5883A4E114E5B7A6E374043D8EFD329C253
   r = DEAA646EC2AF2EA8AD53ED66B2E2DDAA49A12EFD8356561451F3E21C
   s = 95987796F6CF2062AB8135271DE56AE55366C045F6D9593F53787BD2

   With SHA-224, message = "test":
   k = DF8B38D40DCA3E077D0AC520BF56B6D565134D9B5F2EAE0D34900524
   r = C441CE8E261DED634E4CF84910E4C5D1D22C5CF3B732BB204DBEF019
   s = 902F42847A63BDC5F6046ADA114953120F99442D76510150F372A3F4

   With SHA-256, message = "test":
   k = FF86F57924DA248D6E44E8154EB69F0AE2AEBAEE9931D0B5A969F904
   r = AD04DDE87B84747A243A631EA47A1BA6D1FAA059149AD2440DE6FBA6
   s = 178D49B1AE90E3D8B629BE3DB5683915F4E8C99FDF6E666CF37ADCFD

   With SHA-384, message = "test":
   k = 7046742B839478C1B5BD31DB2E862AD868E1A45C863585B5F22BDC2D
   r = 389B92682E399B26518A95506B52C03BC9379A9DADF3391A21FB0EA4
   s = 414A718ED3249FF6DBC5B50C27F71F01F070944DA22AB1F78F559AAB

   With SHA-512, message = "test":
   k = E39C2AA4EA6BE2306C72126D40ED77BF9739BB4D6EF2BBB1DCB6169D
   r = 049F050477C5ADD858CAC56208394B5A55BAEBBE887FDF765047C17C
   s = 077EB13E7005929CEFA3CD0403C7CDCC077ADF4E44F3C41B2F60ECFF

Pornin                        Informational                    [Page 32]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.5.  ECDSA, 256 Bits (Prime Field)

   Key pair:

   curve: NIST P-256

   (qlen = 256 bits)

   private key:

   x = C9AFA9D845BA75166B5C215767B1D6934E50C3DB36E89B127B8A622B120F6721

   public key: U = xG

   Ux = 60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6

   Uy = 7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299


   With SHA-1, message = "sample":
   k = 882905F1227FD620FBF2ABF21244F0BA83D0DC3A9103DBBEE43A1FB858109DB4
   r = 61340C88C3AAEBEB4F6D667F672CA9759A6CCAA9FA8811313039EE4A35471D32
   s = 6D7F147DAC089441BB2E2FE8F7A3FA264B9C475098FDCF6E00D7C996E1B8B7EB

   With SHA-224, message = "sample":
   k = 103F90EE9DC52E5E7FB5132B7033C63066D194321491862059967C715985D473
   r = 53B2FFF5D1752B2C689DF257C04C40A587FABABB3F6FC2702F1343AF7CA9AA3F
   s = B9AFB64FDC03DC1A131C7D2386D11E349F070AA432A4ACC918BEA988BF75C74C

   With SHA-256, message = "sample":
   k = A6E3C57DD01ABE90086538398355DD4C3B17AA873382B0F24D6129493D8AAD60
   r = EFD48B2AACB6A8FD1140DD9CD45E81D69D2C877B56AAF991C34D0EA84EAF3716
   s = F7CB1C942D657C41D436C7A1B6E29F65F3E900DBB9AFF4064DC4AB2F843ACDA8

   With SHA-384, message = "sample":
   k = 09F634B188CEFD98E7EC88B1AA9852D734D0BC272F7D2A47DECC6EBEB375AAD4
   r = 0EAFEA039B20E9B42309FB1D89E213057CBF973DC0CFC8F129EDDDC800EF7719
   s = 4861F0491E6998B9455193E34E7B0D284DDD7149A74B95B9261F13ABDE940954

   With SHA-512, message = "sample":
   k = 5FA81C63109BADB88C1F367B47DA606DA28CAD69AA22C4FE6AD7DF73A7173AA5
   r = 8496A60B5E9B47C825488827E0495B0E3FA109EC4568FD3F8D1097678EB97F00
   s = 2362AB1ADBE2B8ADF9CB9EDAB740EA6049C028114F2460F96554F61FAE3302FE

Pornin                        Informational                    [Page 33]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 8C9520267C55D6B980DF741E56B4ADEE114D84FBFA2E62137954164028632A2E
   r = 0CBCC86FD6ABD1D99E703E1EC50069EE5C0B4BA4B9AC60E409E8EC5910D81A89
   s = 01B9D7B73DFAA60D5651EC4591A0136F87653E0FD780C3B1BC872FFDEAE479B1

   With SHA-224, message = "test":
   k = 669F4426F2688B8BE0DB3A6BD1989BDAEFFF84B649EEB84F3DD26080F667FAA7
   r = C37EDB6F0AE79D47C3C27E962FA269BB4F441770357E114EE511F662EC34A692
   s = C820053A05791E521FCAAD6042D40AEA1D6B1A540138558F47D0719800E18F2D

   With SHA-256, message = "test":
   k = D16B6AE827F17175E040871A1C7EC3500192C4C92677336EC2537ACAEE0008E0
   r = F1ABB023518351CD71D881567B1EA663ED3EFCF6C5132B354F28D3B0B7D38367
   s = 019F4113742A2B14BD25926B49C649155F267E60D3814B4C0CC84250E46F0083

   With SHA-384, message = "test":
   k = 16AEFFA357260B04B1DD199693960740066C1A8F3E8EDD79070AA914D361B3B8
   r = 83910E8B48BB0C74244EBDF7F07A1C5413D61472BD941EF3920E623FBCCEBEB6
   s = 8DDBEC54CF8CD5874883841D712142A56A8D0F218F5003CB0296B6B509619F2C

   With SHA-512, message = "test":
   k = 6915D11632ACA3C40D5D51C08DAF9C555933819548784480E93499000D9F0B7F
   r = 461D93F31B6540894788FD206C07CFA0CC35F46FA3C91816FFF1040AD1581A04
   s = 39AF9F15DE0DB8D97E72719C74820D304CE5226E32DEDAE67519E840D1194E55

Pornin                        Informational                    [Page 34]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.6.  ECDSA, 384 Bits (Prime Field)

   Key pair:

   curve: NIST P-384

   (qlen = 384 bits)

   private key:

   x = 6B9D3DAD2E1B8C1C05B19875B6659F4DE23C3B667BF297BA9AA47740787137D8

   public key: U = xG

   Ux = EC3A4E415B4E19A4568618029F427FA5DA9A8BC4AE92E02E06AAE5286B300C64

   Uy = 8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1


   With SHA-1, message = "sample":
   k = 4471EF7518BB2C7C20F62EAE1C387AD0C5E8E470995DB4ACF694466E6AB09663
   r = EC748D839243D6FBEF4FC5C4859A7DFFD7F3ABDDF72014540C16D73309834FA3
   s = A3BCFA947BEEF4732BF247AC17F71676CB31A847B9FF0CBC9C9ED4C1A5B3FACF

   With SHA-224, message = "sample":
   k = A4E4D2F0E729EB786B31FC20AD5D849E304450E0AE8E3E341134A5C1AFA03CAB
   r = 42356E76B55A6D9B4631C865445DBE54E056D3B3431766D0509244793C3F9366
   s = 9DA0C81787064021E78DF658F2FBB0B042BF304665DB721F077A4298B095E483

   With SHA-256, message = "sample":
   k = 180AE9F9AEC5438A44BC159A1FCB277C7BE54FA20E7CF404B490650A8ACC414E
   r = 21B13D1E013C7FA1392D03C5F99AF8B30C570C6F98D4EA8E354B63A21D3DAA33
   s = F3AA443FB107745BF4BD77CB3891674632068A10CA67E3D45DB2266FA7D1FEEB

Pornin                        Informational                    [Page 35]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-384, message = "sample":
   k = 94ED910D1A099DAD3254E9242AE85ABDE4BA15168EAF0CA87A555FD56D10FBCA
   r = 94EDBB92A5ECB8AAD4736E56C691916B3F88140666CE9FA73D64C4EA95AD133C
   s = 99EF4AEB15F178CEA1FE40DB2603138F130E740A19624526203B6351D0A3A94F

   With SHA-512, message = "sample":
   k = 92FC3C7183A883E24216D1141F1A8976C5B0DD797DFA597E3D7B32198BD35331
   r = ED0959D5880AB2D869AE7F6C2915C6D60F96507F9CB3E047C0046861DA4A799C
   s = 512C8CCEEE3890A84058CE1E22DBC2198F42323CE8ACA9135329F03C068E5112

   With SHA-1, message = "test":
   k = 66CC2C8F4D303FC962E5FF6A27BD79F84EC812DDAE58CF5243B64A4AD8094D47
   r = 4BC35D3A50EF4E30576F58CD96CE6BF638025EE624004A1F7789A8B8E43D0678
   s = D5A6326C494ED3FF614703878961C0FDE7B2C278F9A65FD8C4B7186201A29916

   With SHA-224, message = "test":
   k = 18FA39DB95AA5F561F30FA3591DC59C0FA3653A80DAFFA0B48D1A4C6DFCBFF6E
   r = E8C9D0B6EA72A0E7837FEA1D14A1A9557F29FAA45D3E7EE888FC5BF954B5E624
   s = 07041D4A7A0379AC7232FF72E6F77B6DDB8F09B16CCE0EC3286B2BD43FA8C614

   With SHA-256, message = "test":
   k = 0CFAC37587532347DC3389FDC98286BBA8C73807285B184C83E62E26C401C0FA
   r = 6D6DEFAC9AB64DABAFE36C6BF510352A4CC27001263638E5B16D9BB51D451559
   s = 2D46F3BECBCC523D5F1A1256BF0C9B024D879BA9E838144C8BA6BAEB4B53B47D

   With SHA-384, message = "test":
   k = 015EE46A5BF88773ED9123A5AB0807962D193719503C527B031B4C2D225092AD
   r = 8203B63D3C853E8D77227FB377BCF7B7B772E97892A80F36AB775D509D7A5FEB
   s = DDD0760448D42D8A43AF45AF836FCE4DE8BE06B485E9B61B827C2F13173923E0

Pornin                        Informational                    [Page 36]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 3780C4F67CB15518B6ACAE34C9F83568D2E12E47DEAB6C50A4E4EE5319D1E8CE
   r = A0D5D090C9980FAF3C2CE57B7AE951D31977DD11C775D314AF55F76C676447D0
   s = 976984E59B4C77B0E8E4460DCA3D9F20E07B9BB1F63BEEFAF576F6B2E8B22463

Pornin                        Informational                    [Page 37]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.7.  ECDSA, 521 Bits (Prime Field)

   Key pair:

   curve: NIST P-521

   (qlen = 521 bits)

   private key:

   x = 0FAD06DAA62BA3B25D2FB40133DA757205DE67F5BB0018FEE8C86E1B68C7E75C

   public key: U = xG

   Ux = 1894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD3

   Uy = 0493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A2


   With SHA-1, message = "sample":
   k = 089C071B419E1C2820962321787258469511958E80582E95D8378E0C2CCDB3CB
   r = 0343B6EC45728975EA5CBA6659BBB6062A5FF89EEA58BE3C80B619F322C87910
   s = 0E7B0E675A9B24413D448B8CC119D2BF7B2D2DF032741C096634D6D65D0DBE3D

Pornin                        Informational                    [Page 38]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-224, message = "sample":
   k = 121415EC2CD7726330A61F7F3FA5DE14BE9436019C4DB8CB4041F3B54CF31BE0
   r = 1776331CFCDF927D666E032E00CF776187BC9FDD8E69D0DABB4109FFE1B5E2A3
   s = 050CB5265417FE2320BBB5A122B8E1A32BD699089851128E360E620A30C7E17B

   With SHA-256, message = "sample":
   k = 0EDF38AFCAAECAB4383358B34D67C9F2216C8382AAEA44A3DAD5FDC9C3257576
   r = 1511BB4D675114FE266FC4372B87682BAECC01D3CC62CF2303C92B3526012659
   s = 04A171143A83163D6DF460AAF61522695F207A58B95C0644D87E52AA1A347916

   With SHA-384, message = "sample":
   k = 1546A108BC23A15D6F21872F7DED661FA8431DDBD922D0DCDB77CC878C8553FF
   r = 1EA842A0E17D2DE4F92C15315C63DDF72685C18195C2BB95E572B9C5136CA4B4
   s = 1F21A3CEE066E1961025FB048BD5FE2B7924D0CD797BABE0A83B66F1E35EEAF5

   With SHA-512, message = "sample":
   k = 1DAE2EA071F8110DC26882D4D5EAE0621A3256FC8847FB9022E2B7D28E6F1019
   r = 0C328FAFCBD79DD77850370C46325D987CB525569FB63C5D3BC53950E6D4C5F1
   s = 0617CCE7CF5064806C467F678D3B4080D6F1CC50AF26CA209417308281B68AF2

Pornin                        Informational                    [Page 39]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 0BB9F2BF4FE1038CCF4DABD7139A56F6FD8BB1386561BD3C6A4FC818B20DF5DD
   r = 13BAD9F29ABE20DE37EBEB823C252CA0F63361284015A3BF430A46AAA80B87B0
   s = 1E9BB81FF7944CA409AD138DBBEE228E1AFCC0C890FC78EC8604639CB0DBDC90

   With SHA-224, message = "test":
   k = 040D09FCF3C8A5F62CF4FB223CBBB2B9937F6B0577C27020A99602C25A011369
   r = 1C7ED902E123E6815546065A2C4AF977B22AA8EADDB68B2C1110E7EA44D42086
   s = 177336676304FCB343CE028B38E7B4FBA76C1C1B277DA18CAD2A8478B2A9A9F5

   With SHA-256, message = "test":
   k = 01DE74955EFAABC4C4F17F8E84D881D1310B5392D7700275F82F145C61E84384
   r = 00E871C4A14F993C6C7369501900C4BC1E9C7B0B4BA44E04868B30B41D807104
   s = 0CD52DBAA33B063C3A6CD8058A1FB0A46A4754B034FCC644766CA14DA8CA5CA9

   With SHA-384, message = "test":
   k = 1F1FC4A349A7DA9A9E116BFDD055DC08E78252FF8E23AC276AC88B1770AE0B5D
   r = 14BEE21A18B6D8B3C93FAB08D43E739707953244FDBE924FA926D76669E7AC8C
   s = 133330865C067A0EAF72362A65E2D7BC4E461E8C8995C3B6226A21BD1AA78F0E

Pornin                        Informational                    [Page 40]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 16200813020EC986863BEDFC1B121F605C1215645018AEA1A7B215A564DE9EB1
   r = 13E99020ABF5CEE7525D16B69B229652AB6BDF2AFFCAEF38773B4B7D08725F10
   s = 1FBD0013C674AA79CB39849527916CE301C66EA7CE8B80682786AD60F98F7E78

Pornin                        Informational                    [Page 41]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.8.  ECDSA, 163 Bits (Binary Field, Koblitz Curve)

   Key pair:

   curve: NIST K-163

   q = 4000000000000000000020108A2E0CC0D99F8A5EF
   (qlen = 163 bits)

   private key:

   x = 09A4D6792295A7F730FC3F2B49CBC0F62E862272F

   public key: U = xG

   Ux = 79AEE090DB05EC252D5CB4452F356BE198A4FF96F

   Uy = 782E29634DDC9A31EF40386E896BAA18B53AFA5A3


   With SHA-1, message = "sample":
   k = 09744429FA741D12DE2BE8316E35E84DB9E5DF1CD
   r = 30C45B80BA0E1406C4EFBBB7000D6DE4FA465D505
   s = 38D87DF89493522FC4CD7DE1553BD9DBBA2123011

   With SHA-224, message = "sample":
   k = 323E7B28BFD64E6082F5B12110AA87BC0D6A6E159
   r = 38A2749F7EA13BD5DA0C76C842F512D5A65FFAF32
   s = 064F841F70112B793FD773F5606BFA5AC2A04C1E8

   With SHA-256, message = "sample":
   k = 23AF4074C90A02B3FE61D286D5C87F425E6BDD81B
   r = 113A63990598A3828C407C0F4D2438D990DF99A7F
   s = 1313A2E03F5412DDB296A22E2C455335545672D9F

   With SHA-384, message = "sample":
   k = 2132ABE0ED518487D3E4FA7FD24F8BED1F29CCFCE
   r = 34D4DE955871BB84FEA4E7D068BA5E9A11BD8B6C4
   s = 2BAAF4D4FD57F175C405A2F39F9755D9045C820BD

   With SHA-512, message = "sample":
   k = 00BBCC2F39939388FDFE841892537EC7B1FF33AA3
   r = 38E487F218D696A7323B891F0CCF055D895B77ADC
   s = 0972D7721093F9B3835A5EB7F0442FA8DCAA873C4

Pornin                        Informational                    [Page 42]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 14CAB9192F39C8A0EA8E81B4B87574228C99CD681
   r = 1375BEF93F21582F601497036A7DC8014A99C2B79
   s = 254B7F1472FFFEE9002D081BB8CE819CCE6E687F9

   With SHA-224, message = "test":
   k = 091DD986F38EB936BE053DD6ACE3419D2642ADE8D
   r = 110F17EF209957214E35E8C2E83CBE73B3BFDEE2C
   s = 057D5022392D359851B95DEC2444012502A5349CB

   With SHA-256, message = "test":
   k = 193649CE51F0CFF0784CFC47628F4FA854A93F7A2
   r = 0354D5CD24F9C41F85D02E856FA2B0001C83AF53E
   s = 020B200677731CD4FE48612A92F72A19853A82B65

   With SHA-384, message = "test":
   k = 37C73C6F8B404EC83DA17A6EBCA724B3FF1F7EEBA
   r = 11B6A84206515495AD8DBB2E5785D6D018D75817E
   s = 1A7D4C1E17D4030A5D748ADEA785C77A54581F6D0

   With SHA-512, message = "test":
   k = 331AD98D3186F73967B1E0B120C80B1E22EFC2988
   r = 148934745B351F6367FF5BB56B1848A2F508902A9
   s = 36214B19444FAB504DBA61D4D6FF2D2F9640F4837

Pornin                        Informational                    [Page 43]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.9.  ECDSA, 233 Bits (Binary Field, Koblitz Curve)

   Key pair:

   curve: NIST K-233

   q = 8000000000000000000000000000069D5BB915BCD46EFB1AD5F173ABDF
   (qlen = 232 bits)

   private key:

   x = 103B2142BDC2A3C3B55080D09DF1808F79336DA2399F5CA7171D1BE9B0

   public key: U = xG

   Ux = 0682886F36C68473C1A221720C2B12B9BE13458BA907E1C4736595779F2

   Uy = 1B20639B41BE0927090999B7817A3B3928D20503A39546044EC13A10309


   With SHA-1, message = "sample":
   k = 273179E3E12C69591AD3DD9C7CCE3985820E3913AB6696EB14486DDBCF
   r = 5474541C988A9A1F73899F55EF28963DFFBBF0C2B1A1EE787C6A76C6A4
   s = 46301F9EC6624257BFC70D72186F17898EDBD0A3522560A88DD1B7D45A

   With SHA-224, message = "sample":
   k = 71626A309D9CD80AD0B975D757FE6BF4B84E49F8F34C780070D7746F19
   r = 667F2FCE3E1C497EBD8E4B7C6372A8234003FE4ED6D4515814E7E11430
   s = 6A1C41340DAA730320DB9475F10E29A127D7AE3432F155E1F7954E1B57

   With SHA-256, message = "sample":
   k = 73552F9CAC5774F74F485FA253871F2109A0C86040552EAA67DBA92DC9
   r = 38AD9C1D2CB29906E7D63C24601AC55736B438FB14F4093D6C32F63A10
   s = 647AAD2599C21B6EE89BE7FF957D98F684B7921DE1FD3CC82C079624F4

   With SHA-384, message = "sample":
   k = 17D726A67539C609BD99E29AA3737EF247724B71455C3B6310034038C8
   r = 0C6510F57559C36FBCFF8C7BA4B81853DC618AD0BAAB03CFFDF3FD09FD
   s = 0AD331EE1C9B91A88BA77997235769C60AD07EE69E11F7137E17C5CF67

   With SHA-512, message = "sample":
   k = 0E535C328774CDE546BE3AF5D7FCD263872F107E807435105BA2FDC166
   r = 47C4AC1B344028CC740BA7BB9F8AA59D6390E3158153D4F2ADE4B74950
   s = 26CE0CDE18A1B884B3EE1A879C13B42F11BB7C85F7A3745C8BECEC8E6E

Pornin                        Informational                    [Page 44]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 1D8BBF5CB6EFFA270A1CDC22C81E269F0CC16E27151E0A460BA9B51AFF
   r = 4780B2DE4BAA5613872179AD90664249842E8B96FCD5653B55DD63EED4
   s = 6AF46BA322E21D4A88DAEC1650EF38774231276266D6A45ED6A64ECB44

   With SHA-224, message = "test":
   k = 67634D0ABA2C9BF7AE54846F26DCD166E7100654BCE6FDC96667631AA2
   r = 61D9CC8C842DF19B3D9F4BDA0D0E14A957357ADABC239444610FB39AEA
   s = 66432278891CB594BA8D08A0C556053D15917E53449E03C2EF88474CF6

   With SHA-256, message = "test":
   k = 2CE5AEDC155ACC0DDC5E679EBACFD21308362E5EFC05C5E99B2557A8D7
   r = 05E4E6B4DB0E13034E7F1F2E5DBAB766D37C15AE4056C7EE607C8AC7F4
   s = 5FC46AA489BF828B34FBAD25EC432190F161BEA8F60D3FCADB0EE3B725

   With SHA-384, message = "test":
   k = 1B4BD3903E74FD0B31E23F956C70062014DFEFEE21832032EA5352A055
   r = 50F1EFEDFFEC1088024620280EE0D7641542E4D4B5D61DB32358FC571B
   s = 4614EAE449927A9EB2FCC42EA3E955B43D194087719511A007EC9217A5

   With SHA-512, message = "test":
   k = 1775ED919CA491B5B014C5D5E86AF53578B5A7976378F192AF665CB705
   r = 6FE6D0D3A953BB66BB01BC6B9EDFAD9F35E88277E5768D1B214395320F
   s = 7C01A236E4BFF0A771050AD01EC1D24025D3130BBD9E4E81978EB3EC09

Pornin                        Informational                    [Page 45]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.10.  ECDSA, 283 Bits (Binary Field, Koblitz Curve)

   Key pair:

   curve: NIST K-283

   (qlen = 281 bits)

   private key:

   x = 06A0777356E87B89BA1ED3A3D845357BE332173C8F7A65BDC7DB4FAB3C4CC79A

   public key: U = xG

   Ux = 25330D0A651D5A20DC6389BC02345117725640AEC3C126612CE444EDD19649BD

   Uy = 505BD60A4B67182474EC4D1C668A73140F70504A68F39EFCD972487E9530E050


   With SHA-1, message = "sample":
   k = 0A96F788DECAF6C9DBE24DC75ABA6EAAE85E7AB003C8D4F83CB1540625B2993B
   r = 1B66D1E33FBDB6E107A69B610995C93C744CEBAEAF623CB42737C27D60188BD1
   s = 02E45B62C9C258643532FD536594B46C63B063946494F95DAFF8759FD5525023

   With SHA-224, message = "sample":
   k = 1B4C4E3B2F6B08B5991BD2BDDE277A7016DA527AD0AAE5BC61B64C5A0EE63E8B
   r = 018CF2F371BE86BB62E02B27CDE56DDAC83CCFBB3141FC59AEE022B66AC1A60D
   s = 1854E02A381295EA7F184CEE71AB7222D6974522D3B99B309B1A8025EB84118A

   With SHA-256, message = "sample":
   k = 1CEB9E8E0DFF53CE687DEB81339ACA3C98E7A657D5A9499EF779F887A934408E
   r = 19E90AA3DE5FB20AED22879F92C6FED278D9C9B9293CC5E94922CD952C9DBF20
   s = 135AA7443B6A25D11BB64AC482E04D47902D017752882BD72527114F46CF8BB5

Pornin                        Informational                    [Page 46]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-384, message = "sample":
   k = 1460A5C41745A5763A9D548AE62F2C3630BBED71B6AA549D7F829C22442A728C
   r = 0F8C1CA9C221AD9907A136F787D33BA56B0495A40E86E671C940FD767EDD75EB
   s = 1071A56915DEE89E22E511975AA09D00CDC4AA7F5054CBE83F5977EE6F8E1CC3

   With SHA-512, message = "sample":
   k = 00F3B59FCB5C1A01A1A2A0019E98C244DFF61502D6E6B9C4E957EDDCEB258EF4
   r = 1D0008CF4BA4A701BEF70771934C2A4A87386155A2354140E2ED52E18553C35B
   s = 0D15F4FA1B7A4D41D9843578E22EF98773179103DC4FF0DD1F74A6B5642841B9

   With SHA-1, message = "test":
   k = 168B5F8C0881D4026C08AC5894A2239D219FA9F4DA0600ADAA56D5A1781AF81F
   r = 140932FA7307666A8CCB1E1A09656CC40F5932965841ABD5E8E43559D93CF231
   s = 16A2FD46DA497E5E739DED67F426308C45C2E16528BF2A17EB5D65964FD88B77

   With SHA-224, message = "test":
   k = 045E13EA645CE01D9B25EA38C8A8A170E04C83BB7F231EE3152209FE10EC8B2E
   r = 0E72AF7E39CD72EF21E61964D87C838F977485FA6A7E999000AFA97A381B2445
   s = 1644FF7D848DA1A040F77515082C27C763B1B4BF332BCF5D08251C6B57D80631

   With SHA-256, message = "test":
   k = 0B585A7A68F51089691D6EDE2B43FC4451F66C10E65F134B963D4CBD4EB844B0
   r = 158FAEB2470B306C57764AFC8528174589008449E11DB8B36994B607A65956A5
   s = 0521BC667CA1CA42B5649E78A3D76823C678B7BB3CD58D2E93CD791D53043A6F

   With SHA-384, message = "test":
   k = 1E88738E14482A09EE16A73D490A7FE8739DF500039538D5C4B6C8D6D7F208D6
   r = 1CC4DC5479E0F34C4339631A45AA690580060BF0EB518184C983E0E618C3B93A
   s = 0284D72FF8AFA83DE364502CBA0494BB06D40AE08F9D9746E747EA87240E589B

Pornin                        Informational                    [Page 47]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 00E5F24A223BD459653F682763C3BB322D4EE75DD89C63D4DC61518D543E7658
   r = 1E7912517C6899732E09756B1660F6B96635D638283DF9A8A11D30E008895D7F
   s = 0887E75CBD0B7DD9DE30ED79BDB3D78E4F1121C5EAFF5946918F594F88D36364

Pornin                        Informational                    [Page 48]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.11.  ECDSA, 409 Bits (Binary Field, Koblitz Curve)

   Key pair:

   curve: NIST K-409

   (qlen = 407 bits)

   private key:

   x = 29C16768F01D1B8A89FDA85E2EFD73A09558B92A178A2931F359E4D70AD853E5

   public key: U = xG

   Ux = 0CF923F523FE34A6E863D8BA45FB1FE6D784C8F219C414EEF4DB8362DBBD3CA7

   Uy = 13B1C374D5132978A1B1123EBBE9A5C54D1A9D56B09AFDB4ADE93CCD7C4D332E


   With SHA-1, message = "sample":
   k = 7866E5247F9A3556F983C86E81EDA696AC8489DB40A2862F278603982D304F08
   r = 7192EE99EC7AFE23E02CB1F9850D1ECE620475EDA6B65D04984029408EC1E5A6
   s = 1DE75DE97CBE740FC79A6B5B22BC2B7832C687E6960F0B8173D5D8BE2A75AC6C

   With SHA-224, message = "sample":
   k = 512340DB682C7B8EBE407BF1AA54194DFE85D49025FE0F632C9B8A06A996F2FC
   r = 41C8EDF39D5E4E76A04D24E6BFD4B2EC35F99CD2483478FD8B0A03E99379576E
   s = 659652EEAC9747BCAD58034B25362B6AA61836E1BA50E2F37630813050D43457

   With SHA-256, message = "sample":
   k = 782385F18BAF5A36A588637A76DFAB05739A14163BF723A4417B74BD1469D37A
   r = 49EC220D6D24980693E6D33B191532EAB4C5D924E97E305E2C1CCFE6F1EAEF96
   s = 1A4AB1DD9BAAA21F77C503E1B39E770FFD44718349D54BA4CF08F688CE89D7D7

Pornin                        Informational                    [Page 49]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-384, message = "sample":
   k = 4DA637CB2E5C90E486744E45A73935DD698D4597E736DA332A06EDA8B26D5ABC
   r = 562BB99EE027644EC04E493C5E81B41F261F6BD18FB2FAE3AFEAD91FAB8DD44A
   s = 25BA5F28047DDDBDA7ED7E49DA31B62B20FD9C7E5B8988817BBF738B3F4DFDD2

   With SHA-512, message = "sample":
   k = 57055B293ECFDFE983CEF716166091E573275C53906A39EADC25C89C5EC8D7A7
   r = 16C7E7FB33B5577F7CF6F77762F0F2D531C6E7A3528BD2CF582498C1A48F2007
   s = 2729617EFBF80DA5D2F201AC7910D3404A992C39921C2F65F8CF4601392DFE93

   With SHA-1, message = "test":
   k = 545453D8DC05D220F9A12EF322D0B855E664C72835FABE8A41211453EB8A7CFF
   r = 565648A5BAD24E747A7D7531FA9DBDFCB184ECFEFDB00A319459242B68D0989E
   s = 7420BA6FF72ECC5C92B7CA0309258B5879F26393DB22753B9EC5DF905500A042

   With SHA-224, message = "test":
   k = 3C5352929D4EBE3CCE87A2DCE380F0D2B33C901E61ABC530DAF3506544AB0930
   r = 251DFE54EAEC8A781ADF8A623F7F36B4ABFC7EE0AE78C8406E93B5C3932A8120
   s = 77854C2E72EAA6924CC0B5F6751379D132569843B1C7885978DBBAA6678967F6

   With SHA-256, message = "test":
   k = 251E32DEE10ED5EA4AD7370DF3EFF091E467D5531CA59DE3AA791763715E1169
   r = 58075FF7E8D36844EED0FC3F78B7CFFDEEF6ADE5982D5636552A081923E24841
   s = 0A737469D013A31B91E781CE201100FDE1FA488ABF2252C025C678462D715AD3

   With SHA-384, message = "test":
   k = 11C540EA46C5038FE28BB66E2E9E9A04C9FE9567ADF33D56745953D44C1DC8B5
   r = 1C5C88642EA216682244E46E24B7CE9AAEF9B3F97E585577D158C3CBC3C59825
   s = 1D3FD721C35872C74514359F88AD983E170E5DE5B31AFC0BE12E9F4AB2B2538C

Pornin                        Informational                    [Page 50]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 59527CE953BC09DF5E85155CAE7BB1D7F342265F41635545B06044F844ECB4FA
   r = 1A32CD7764149DF79349DBF79451F4585BB490BD63A200700D7111B45DDA4140
   s = 582AB1076CAFAE23A76244B82341AEFC4C6D8D8060A62A352C33187720C8A37F

Pornin                        Informational                    [Page 51]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.12.  ECDSA, 571 Bits (Binary Field, Koblitz Curve)

   Key pair:

   curve: NIST K-571

   q = 2000000000000000000000000000000000000000000000000000000000000000
   (qlen = 570 bits)

   private key:

   x = 0C16F58550D824ED7B95569D4445375D3A490BC7E0194C41A39DEB732C29396C

   public key: U = xG

   Ux = 6CFB0DF7541CDD4C41EF319EA88E849EFC8605D97779148082EC991C463ED323

   Uy = 1CFC91102F7759A561BD8D5B51AAAEEC7F40E659D67870361990D6DE29F6B4F7


   With SHA-1, message = "sample":
   k = 17F7E360B21BEAE4A757A19ACA77FB404D273F05719A86EAD9D7B3F4D5ED7B46
   r = 0767913F96C82E38B7146A505938B79EC07E9AA3214377651BE968B52C039D3E
   s = 109F89F55FA39FF465E40EBCF869A9B1DB425AEA53AB4ECBCE3C310572F79315

Pornin                        Informational                    [Page 52]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-224, message = "sample":
   k = 0B599D068A1A00498EE0B9AD6F388521F594BD3F234E47F7A1DB6490D7B57D60
   r = 010774B9F14DE6C9525131AD61531FA30987170D43782E9FB84FF0D70F093946
   s = 06DFE9AA5FEA6CF2CEDC06EE1F9FD9853D411F0B958F1C9C519C90A85F6D24C1

   With SHA-256, message = "sample":
   k = 0F79D53E63D89FB87F4D9E6DC5949F5D9388BCFE9EBCB4C2F7CE497814CF40E8
   r = 1604BE98D1A27CEC2D3FA4BD07B42799E07743071E4905D7DCE7F6992B21A27F
   s = 18249377C654B8588475510F7B797081F68C2F8CCCE49F730353B2DA3364B1CD

   With SHA-384, message = "sample":
   k = 0308253C022D25F8A9EBCD24459DD6596590BDEC7895618EEE8A2623A98D2A2B
   r = 1E6D7FB237040EA1904CCBF0984B81B866DE10D8AA93B06364C4A46F6C9573FA
   s = 04F94550072ADA7E8C82B7E83577DD39959577799CDABCEA60E267F36F1BEB98

   With SHA-512, message = "sample":
   k = 0C5EE7070AF55F84EBC43A0D481458CEDE1DCEBB57720A3C92F59B4941A044FE
   r = 086C9E048EADD7D3D2908501086F3AF449A01AF6BEB2026DC381B39530BCDDBE
   s = 09FEE0A68F322B380217FCF6ABFF15D78C432BD8DD82E18B6BA877C01C860E24

Pornin                        Informational                    [Page 53]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 1D056563469E933E4BE064585D84602D430983BFBFD6885A94BA484DF9A7AB03
   r = 1D055F499A3F7E3FC73D6E7D517B470879BDCB14ABC938369F23643C7B96D024
   s = 1621376C53CFE3390A0520D2C657B1FF0EBB10E4B9C2510EDC39D04FEBAF12B8

   With SHA-224, message = "test":
   k = 1DA875065B9D94DBE75C61848D69578BCC267935792624F9887B53C9AF9E43CA
   r = 18709BDE4E9B73D046CE0D48842C97063DA54DCCA28DCB087168FA37DA2BF5FD
   s = 12D8B9E98FBF1D264D78669E236319D8FFD8426C56AFB10C76471EE88D7F0AB1

   With SHA-256, message = "test":
   k = 04DDD0707E81BB56EA2D1D45D7FAFDBDD56912CAE224086802FEA1018DB306C4
   r = 1F5BF6B044048E0E310309FFDAC825290A69634A0D3592DBEE7BE71F69E45412
   s = 1B44CBFB233BFA2A98D5E8B2F0B2C27F9494BEAA77FEB59CDE3E7AE9CB2E385B

   With SHA-384, message = "test":
   k = 0141B53DC6E569D8C0C0718A58A5714204502FDA146E7E2133E56D19E905B794
   r = 11F61A6EFAB6D83053D9C52665B3542FF3F63BD5913E527BDBA07FBAF34BC766
   s = 16BF6341876F051DF224770CC8BA0E4D48B3332568A2B014BC80827BAA89DE18

Pornin                        Informational                    [Page 54]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 14842F97F263587A164B215DD0F912C588A88DC4AB6AF4C530ADC1226F16E086
   r = 0F1E50353A39EA64CDF23081D6BB4B2A91DD73E99D3DD5A1AA1C49B4F6E34A66
   s = 0B385004D7596625028E3FDE72282DE4EDC5B4CE33C1127F21CC37527C90B730

Pornin                        Informational                    [Page 55]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.13.  ECDSA, 163 Bits (Binary Field, Pseudorandom Curve)

   Key pair:

   curve: NIST B-163

   q = 40000000000000000000292FE77E70C12A4234C33
   (qlen = 163 bits)

   private key:

   x = 35318FC447D48D7E6BC93B48617DDDEDF26AA658F

   public key: U = xG

   Ux = 126CF562D95A1D77D387BA75A3EA3A1407F23425A

   Uy = 7D7CB5273C94DA8CA93049AFDA18721C24672BD71


   With SHA-1, message = "sample":
   k = 0707A94C3D352E0A9FE49FB12F264992152A20004
   r = 153FEBD179A69B6122DEBF5BC61EB947B24C93526
   s = 37AC9C670F8CF18045049BAE7DD35553545C19E49

   With SHA-224, message = "sample":
   k = 3B24C5E2C2D935314EABF57A6484289B291ADFE3F
   r = 0A379E69C44F9C16EA3215EA39EB1A9B5D58CC955
   s = 04BAFF5308DA2A7FE2C1742769265AD3ED1D24E74

   With SHA-256, message = "sample":
   k = 3D7086A59E6981064A9CDB684653F3A81B6EC0F0B
   r = 134E00F78FC1CB9501675D91C401DE20DDF228CDC
   s = 373273AEC6C36CB7BAFBB1903A5F5EA6A1D50B624

   With SHA-384, message = "sample":
   k = 3B1E4443443486C7251A68EF184A936F05F8B17C7
   r = 29430B935AF8E77519B0CA4F6903B0B82E6A21A66
   s = 1EA1415306E9353FA5AA54BC7C2581DFBB888440D

   With SHA-512, message = "sample":
   k = 2EDF5CFCAC7553C17421FDF54AD1D2EF928A879D2
   r = 0B2F177A99F9DF2D51CCAF55F015F326E4B65E7A0
   s = 0DF1FB4487E9B120C5E970EFE48F55E406306C3A1

Pornin                        Informational                    [Page 56]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 10024F5B324CBC8954BA6ADB320CD3AB9296983B4
   r = 256D4079C6C7169B8BC92529D701776A269D56308
   s = 341D3FFEC9F1EB6A6ACBE88E3C86A1C8FDEB8B8E1

   With SHA-224, message = "test":
   k = 34F46DE59606D56C75406BFB459537A7CC280AA62
   r = 28ECC6F1272CE80EA59DCF32F7AC2D861BA803393
   s = 0AD4AE2C06E60183C1567D2B82F19421FE3053CE2

   With SHA-256, message = "test":
   k = 38145E3FFCA94E4DDACC20AD6E0997BD0E3B669D2
   r = 227DF377B3FA50F90C1CB3CDCBBDBA552C1D35104
   s = 1F7BEAD92583FE920D353F368C1960D0E88B46A56

   With SHA-384, message = "test":
   k = 375813210ECE9C4D7AB42DDC3C55F89189CF6DFFD
   r = 11811DAFEEA441845B6118A0DFEE8A0061231337D
   s = 36258301865EE48C5C6F91D63F62695002AB55B57

   With SHA-512, message = "test":
   k = 25AD8B393BC1E9363600FDA1A2AB6DF40079179A3
   r = 3B6BB95CA823BE2ED8E3972FF516EB8972D765571
   s = 13DC6F420628969DF900C3FCC48220B38BE24A541

Pornin                        Informational                    [Page 57]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.14.  ECDSA, 233 Bits (Binary Field, Pseudorandom Curve)

   Key pair:

   curve: NIST B-233

   q = 1000000000000000000000000000013E974E72F8A6922031D2603CFE0D7
   (qlen = 233 bits)

   private key:

   x = 07ADC13DD5BF34D1DDEEB50B2CE23B5F5E6D18067306D60C5F6FF11E5D3

   public key: U = xG

   Ux = 0FB348B3246B473AA7FBB2A01B78D61B62C4221D0F9AB55FC72DB3DF478

   Uy = 1162FA1F6C6ACF7FD8D19FC7D74BDD9104076E833898BC4C042A6E6BEBF


   With SHA-1, message = "sample":
   k = 0A4E0B67A3A081C1B35D7BECEB5FE72A918B422B907145DB5416ED751CE
   r = 015CC6FD78BB06E0878E71465515EA5A21A2C18E6FC77B4B158DBEB3944
   s = 0822A4A6C2EB2DF213A5E90BF40377956365EE8C4B4A5A4E2EB9270CB6A

   With SHA-224, message = "sample":
   k = 0F2B1C1E80BEB58283AAA79857F7B83BDF724120D0913606FD07F7FFB2C
   r = 05D9920B53471148E10502AB49AB7A3F11084820A074FD89883CF51BC1A
   s = 04D3938900C0A9AAA7080D1DFEB56CFB0FADABE4214536C7ED5117ED13A

   With SHA-256, message = "sample":
   k = 034A53897B0BBDB484302E19BF3F9B34A2ABFED639D109A388DC52006B5
   r = 0A797F3B8AEFCE7456202DF1E46CCC291EA5A49DA3D4BDDA9A4B62D5E0D
   s = 01F6F81DA55C22DA4152134C661588F4BD6F82FDBAF0C5877096B070DC2

   With SHA-384, message = "sample":
   k = 04D4670B28990BC92EEB49840B482A1FA03FE028D09F3D21F89C67ECA85
   r = 015E85A8D46225DD7E314A1C4289731FC14DECE949349FE535D11043B85
   s = 03F189D37F50493EFD5111A129443A662AB3C6B289129AD8C0CAC85119C

   With SHA-512, message = "sample":
   k = 0DE108AAADA760A14F42C057EF81C0A31AF6B82E8FBCA8DC86E443AB549
   r = 03B62A4BF783919098B1E42F496E65F7621F01D1D466C46940F0F132A95
   s = 0F4BE031C6E5239E7DAA014CBBF1ED19425E49DAEB426EC9DF4C28A2E30

Pornin                        Informational                    [Page 58]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 0250C5C90A4E2A3F8849FEBA87F0D0AE630AB18CBABB84F4FFFB36CEAC0
   r = 02F1FEDC57BE203E4C8C6B8C1CEB35E13C1FCD956AB41E3BD4C8A6EFB1F
   s = 05738EC8A8EDEA8E435EE7266AD3EDE1EEFC2CEBE2BE1D614008D5D2951

   With SHA-224, message = "test":
   k = 07BDB6A7FD080D9EC2FC84BFF9E3E15750789DC04290C84FED00E109BBD
   r = 0CCE175124D3586BA7486F7146894C65C2A4A5A1904658E5C7F9DF5FA5D
   s = 08804B456D847ACE5CA86D97BF79FD6335E5B17F6C0D964B5D0036C867E

   With SHA-256, message = "test":
   k = 00376886E89013F7FF4B5214D56A30D49C99F53F211A3AFE01AA2BDE12D
   r = 035C3D6DFEEA1CFB29B93BE3FDB91A7B130951770C2690C16833A159677
   s = 0600F7301D12AB376B56D4459774159ADB51F97E282FF384406AFD53A02

   With SHA-384, message = "test":
   k = 03726870DE75613C5E529E453F4D92631C03D08A7F63813E497D4CB3877
   r = 061602FC8068BFD5FB86027B97455D200EC603057446CCE4D76DB8EF42C
   s = 03396DD0D59C067BB999B422D9883736CF9311DFD6951F91033BD03CA8D

   With SHA-512, message = "test":
   k = 09CE5810F1AC68810B0DFFBB6BEEF2E0053BB937969AE7886F9D064A8C4
   r = 07E12CB60FDD614958E8E34B3C12DDFF35D85A9C5800E31EA2CC2EF63B1
   s = 0E8970FD99D836F3CC1C807A2C58760DE6EDAA23705A82B9CB1CE93FECC

Pornin                        Informational                    [Page 59]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.15.  ECDSA, 283 Bits (Binary Field, Pseudorandom Curve)

   Key pair:

   curve: NIST B-283

   (qlen = 282 bits)

   private key:

   x = 14510D4BC44F2D26F4553942C98073C1BD35545CEABB5CC138853C5158D2729E

   public key: U = xG

   Ux = 17E3409A13C399F0CA8A192F028D46E3446BCFFCDF51FF8A905ED2DED786E74F

   Uy = 47EFCBCC31C01D86D1992F7BFAC0277DBD02A6D289274099A2C0F039C8F59F31


   With SHA-1, message = "sample":
   k = 277F389559667E8AE4B65DC056F8CE2872E1917E7CC59D17D485B0B98343206F
   r = 201E18D48C6DB3D5D097C4DCE1E25587E1501FC3CF47BDB5B4289D79E273D6A9
   s = 151AE05712B024CE617358260774C8CA8B0E7A7E72EF8229BF2ACE7609560CB3

   With SHA-224, message = "sample":
   k = 14CC8FCFEECD6B999B4DC6084EBB06FDED0B44D5C507802CC7A5E9ECF36E69DA
   r = 143E878DDFD4DF40D97B8CD638B3C4706501C2201CF7108F2FB91478C11D6947
   s = 0CBF1B9717FEEA3AABB09D9654110144267098E0E1E8D0289A6211BE0EEDFDD8

   With SHA-256, message = "sample":
   k = 38C9D662188982943E080B794A4CFB0732DBA37C6F40D5B8CFADED6FF31C5452
   r = 29FD82497FB3E5CEF65579272138DE59E2B666B8689466572B3B69A172CEE83B
   s = 05A89D9166B40795AF0FE5958201B9C0523E500013CA12B4840EA2BC53F25F9B

Pornin                        Informational                    [Page 60]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-384, message = "sample":
   k = 21B7265DEBF90E6F988CFFDB62B121A02105226C652807CC324ED6FB119A287A
   r = 2F00689C1BFCD2A8C7A41E0DE55AE182E6463A152828EF89FE3525139B660329
   s = 1744514FE0A37447250C8A329EAAADA81572226CABA16F39270EE5DD03F27B1F

   With SHA-512, message = "sample":
   k = 20583259DC179D9DA8E5387E89BFF2A3090788CF1496BCABFE7D45BB120B0C81
   r = 0DA43A9ADFAA6AD767998A054C6A8F1CF77A562924628D73C62761847AD8286E
   s = 1D118733AE2C88357827CAFC6F68ABC25C80C640532925E95CFE66D40F8792F3

   With SHA-1, message = "test":
   k = 0185C57A743D5BA06193CE2AA47B07EF3D6067E5AE1A6469BCD3FC510128BA56
   r = 05A408133919F2CDCDBE5E4C14FBC706C1F71BADAFEF41F5DE4EC27272FC1CA9
   s = 012966272872C097FEA7BCE64FAB1A81982A773E26F6E4EF7C99969846E67CA9

   With SHA-224, message = "test":
   k = 2E5C1F00677A0E015EC3F799FA9E9A004309DBD784640EAAF5E1CE64D3045B9F
   r = 08F3824E40C16FF1DDA8DC992776D26F4A5981AB5092956C4FDBB4F1AE0A711E
   s = 0A64B91EFADB213E11483FB61C73E3EF63D3B44EEFC56EA401B99DCC60CC28E9

   With SHA-256, message = "test":
   k = 018A7D44F2B4341FEFE68F6BD8894960F97E08124AAB92C1FFBBE90450FCC935
   r = 3597B406F5329D11A79E887847E5EC60861CCBB19EC61F252DB7BD549C699951
   s = 0A6A100B997BC622D91701D9F5C6F6D3815517E577622DA69D3A0E8917C1CBE6

   With SHA-384, message = "test":
   k = 3C75397BA4CF1B931877076AF29F2E2F4231B117AB4B8E039F7F9704DE1BD352
   r = 1BB490926E5A1FDC7C5AA86D0835F9B994EDA315CA408002AF54A298728D422E
   s = 36C682CFC9E2C89A782BFD3A191609D1F0C1910D5FD6981442070393159D65FB

Pornin                        Informational                    [Page 61]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 14E66B18441FA54C21E3492D0611D2B48E19DE3108D915FD5CA08E786327A267
   r = 19944AA68F9778C2E3D6E240947613E6DA60EFCE9B9B2C063FF5466D72745B5A
   s = 03F1567B3C5B02DF15C874F0EE22850824693D5ADC4663BAA19E384E550B1DD4

Pornin                        Informational                    [Page 62]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.16.  ECDSA, 409 Bits (Binary Field, Pseudorandom Curve)

   Key pair:

   curve: NIST B-409

   q = 10000000000000000000000000000000000000000000000000001E2AAD6A612F
   (qlen = 409 bits)

   private key:

   x = 0494994CC325B08E7B4CE038BD9436F90B5E59A2C13C3140CD3AE07C04A01FC4

   public key: U = xG

   Ux = 1A7055961CF1DA4B9A015B18B1524EF01FDD9B93FAEFC26FB1F2F828A7227B70

   Uy = 18105C042F290736088F30AEC7AE7732A45DE47BCE0940113AB8132516D1E059


   With SHA-1, message = "sample":
   k = 042D8A2B34402757EB2CCFDDC3E6E96A7ADD3FDA547FC10A0CB77CFC720B4F9E
   r = 0D8783188E1A540E2022D389E1D35B32F56F8C2BB5636B8ABF7718806B27A713
   s = 03A6B4A80E204DB0DE12E7415C13C9EC091C52935658316B4A0C591216A38791

   With SHA-224, message = "sample":
   k = 0C933F1DC4C70838C2AD16564715ACAF545BCDD8DC203D25AF3EC63949C65CB2
   r = 0EE4F39ACC2E03CE96C3D9FCBAFA5C22C89053662F8D4117752A9B10F09ADFDA
   s = 00A2B83265B456A430A8BF27DCC8A9488B3F126C10F0D6D64BF7B8A218FAAF20

   With SHA-256, message = "sample":
   k = 08EC42D13A3909A20C41BEBD2DFED8CACCE56C7A7D1251DF43F3E9E289DAE00E
   r = 02D8B1B31E33E74D7EB46C30FDE5AD2CA04EC8FE08FBA0E73BA5E568953AC5EA
   s = 079F7D471E6CB73234AF7F7C381D2CE15DE35BAF8BB68393B73235B3A26EC2DF

Pornin                        Informational                    [Page 63]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-384, message = "sample":
   k = 0DA881BCE3BA851485879EF8AC585A63F1540B9198ECB8A1096D70CB25A104E2
   r = 07BC638B7E7CE6FEE5E9C64A0F966D722D01BB4BC3F3A35F30D4CDDA92DFC5F7
   s = 06D904429850521B28A32CBF55C7C0FDF35DC4E0BDA2552C7BF68A171E970E67

   With SHA-512, message = "sample":
   k = 0750926FFAD7FF5DE85DF7960B3A4F9E3D38CF5A049BFC89739C48D42B34FBEE
   r = 05D178DECAFD2D02A3DA0D8BA1C4C1D95EE083C760DF782193A9F7B4A8BE6FC5
   s = 013B7581E98F6A63FBBCB3E49BCDA60F816DB230B888506D105DC229600497C3

   With SHA-1, message = "test":
   k = 017E167EAB1850A3B38EE66BFE2270F2F6BFDAC5E2D227D47B20E75F0719161E
   r = 049F54E7C10D2732B4638473053782C6919218BBEFCEC8B51640FC193E832291
   s = 0499E267DEC84E02F6F108B10E82172C414F15B1B7364BE8BFD66ADC0C5DE23F

   With SHA-224, message = "test":
   k = 01ADEB94C19951B460A146B8275D81638C07735B38A525D76023AAF26AA8A058
   r = 0B1527FFAA7DD7C7E46B628587A5BEC0539A2D04D3CF27C54841C2544E1BBDB4
   s = 0442C68C044868DF4832C807F1EDDEBF7F5052A64B826FD03451440794063F52

   With SHA-256, message = "test":
   k = 06EBA3D58D0E0DFC406D67FC72EF0C943624CF40019D1E48C3B54CCAB0594AFD
   r = 0BB27755B991D6D31757BCBF68CB01225A38E1CFA20F775E861055DD108ED7EA
   s = 0C5BE90980E7F444B5F7A12C9E9AC7A04CA81412822DD5AD1BE7C45D5032555E

   With SHA-384, message = "test":
   k = 0A45B787DB44C06DEAB846511EEDBF7BFCFD3BD2C11D965C92FC195F67328F36
   r = 04EFEB7098772187907C87B33E0FBBA4584226C50C11E98CA7AAC6986F8D3BE0
   s = 09574102FEB3EF87E6D66B94119F5A6062950FF4F902EA1E6BD9E2037F33FF99

Pornin                        Informational                    [Page 64]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 0B90F8A0E757E81D4EA6891766729C96A6D01F9AEDC0D334932D1F81CC4E1973
   r = 07E0249C68536AE2AEC2EC30090340DA49E6DC9E9EEC8F85E5AABFB234B6DA7D
   s = 08125B5A03FB44AE81EA46D446130C2A415ECCA265910CA69D55F2453E16CD7B

Pornin                        Informational                    [Page 65]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.2.17.  ECDSA, 571 Bits (Binary Field, Pseudorandom Curve)

   Key pair:

   curve: NIST B-571

   (qlen = 570 bits)

   private key:

   x = 028A04857F24C1C082DF0D909C0E72F453F2E2340CCB071F0E389BCA2575DA19

   public key: U = xG

   Ux = 4B4B3CE9377550140B62C1061763AA524814DDCEF37B00CD5CDE94F7792BB0E9

   Uy = 4453B18F261E7A0E7570CD72F235EA750438E43946FBEBD2518B696954767AA7


   With SHA-1, message = "sample":
   k = 2669FAFEF848AF67D437D4A151C3C5D3F9AA8BB66EDC35F090C9118F95BA0041
   r = 147D3EB0EDA9F2152DFD014363D6A9CE816D7A1467D326A625FC4AB0C786E1B7
   s = 17319571CAF533D90D2E78A64060B9C53169AB7FC908947B3EDADC54C79CCF0A

Pornin                        Informational                    [Page 66]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-224, message = "sample":
   k = 2EAFAD4AC8644DEB29095BBAA88D19F31316434F1766AD4423E0B54DD2FE0C05
   r = 10F4B63E79B2E54E4F4F6A2DBC786D8F4A143ECA7B2AD97810F6472AC6AE2085
   s = 3BBEA07C6B269C2B7FE9AE4DDB118338D0C2F0022920A7F9DCFCB7489594C03B

   With SHA-256, message = "sample":
   k = 15C2C6B7D1A070274484774E558B69FDFA193BDB7A23F27C2CD24298CE1B22A6
   r = 213EF9F3B0CFC4BF996B8AF3A7E1F6CACD2B87C8C63820000800AC787F17EC99
   s = 3D32322559B094E20D8935E250B6EC139AC4AAB77920812C119AF419FB62B332

   With SHA-384, message = "sample":
   k = 0FEF0B68CB49453A4C6ECBF1708DBEEFC885C57FDAFB88417AAEFA5B1C35017B
   r = 375D8F49C656A0BBD21D3F54CDA287D853C4BB1849983CD891EF6CD6BB56A62B
   s = 1CDEC6F46DFEEE44BCE71D41C60550DC67CF98D6C91363625AC2553E4368D2DF

   With SHA-512, message = "sample":
   k = 3FF373833A06C791D7AD586AFA3990F6EF76999C35246C4AD0D519BFF180CA18
   r = 1C26F40D940A7EAA0EB1E62991028057D91FEDA0366B606F6C434C361F04E545
   s = 3691DE4369D921FE94EDDA67CB71FBBEC9A436787478063EB1CC778B3DCDC1C4

Pornin                        Informational                    [Page 67]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-1, message = "test":
   k = 019B506FD472675A7140E429AA5510DCDDC21004206EEC1B39B28A688A8FD324
   r = 133F5414F2A9BC41466D339B79376038A64D045E5B0F792A98E5A7AA87E0AD01
   s = 3D16743AE9F00F0B1A500F738719C5582550FEB64689DA241665C4CE4F328BA0

   With SHA-224, message = "test":
   k = 333C711F8C62F205F926593220233B06228285261D34026232F6F729620C6DE1
   r = 3048E76506C5C43D92B2E33F62B33E3111CEEB87F6C7DF7C7C01E3CDA28FA5E8
   s = 2C99078CCFE5C82102B8D006E3703E020C46C87C75163A2CD839C885550BA5CB

   With SHA-256, message = "test":
   k = 328E02CF07C7B5B6D3749D8302F1AE5BFAA8F239398459AF4A2C859C7727A812
   r = 184BC808506E11A65D628B457FDA60952803C604CC7181B59BD25AEE1411A66D
   s = 27280D45F81B19334DBDB07B7E63FE8F39AC7E9AE14DE1D2A6884D2101850289

   With SHA-384, message = "test":
   k = 2A77E29EAD9E811A9FDA0284C14CDFA1D9F8FA712DA59D530A06CDE54187E250
   r = 319EE57912E7B0FAA1FBB145B0505849A89C6DB1EC06EA20A6A7EDE072A6268A
   s = 2CF3EA27EADD0612DD2F96F46E89AB894B01A10DF985C5FC099CFFE0EA083EB4

Pornin                        Informational                    [Page 68]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   With SHA-512, message = "test":
   k = 21CE6EE4A2C72C9F93BDB3B552F4A633B8C20C200F894F008643240184BE57BB
   r = 2AA1888EAB05F7B00B6A784C4F7081D2C833D50794D9FEAF6E22B8BE728A2A90
   s = 0AA5371FE5CA671D6ED9665849C37F394FED85D51FEF72DA2B5F28EDFB2C6479

Pornin                        Informational                    [Page 69]

RFC 6979               Deterministic DSA and ECDSA           August 2013

A.3.  Sample Code

   We include here a sample implementation of deterministic DSA.  It is
   meant for illustration purposes; for instance, this code makes no
   attempt at avoiding side-channel leakage of the private key.  It is
   written in the Java programming language.  The actual generation of
   the "random" value k is done in the computek() method.  The Java
   virtual machine (JVM) is assumed to provide the implementation of the
   hash function and of HMAC.

  // ==================================================================

  import java.math.BigInteger;
  import java.security.InvalidKeyException;
  import java.security.MessageDigest;
  import java.security.NoSuchAlgorithmException;
  import javax.crypto.Mac;
  import javax.crypto.spec.SecretKeySpec;

   * Deterministic DSA signature generation.  This is a sample
   * implementation designed to illustrate how deterministic DSA
   * chooses the pseudorandom value k when signing a given message.
   * This implementation was NOT optimized or hardened against
   * side-channel leaks.
   * An instance is created with a hash function name, which must be
   * supported by the underlying Java virtual machine ("SHA-1" and
   * "SHA-256" should work everywhere).  The data to sign is input
   * through the {@code update()} methods.  The private key is set with
   * {@link #setPrivateKey}.  The signature is obtained by calling
   * {@link #sign}; alternatively, {@link #signHash} can be used to
   * sign some data that has been externally hashed.  The private key
   * MUST be set before generating the signature itself, but message
   * data can be input before setting the key.
   * Instances are NOT thread-safe.  However, once a signature has
   * been generated, the same instance can be used again for another
   * signature; {@link #setPrivateKey} need not be called again if the
   * private key has not changed.  {@link #reset} can also be called to
   * cancel previously input data.  Generating a signature with {@link
   * #sign} (not {@link #signHash}) also implicitly causes a
   * reset.
   * ------------------------------------------------------------------
   * Copyright (c) 2013 IETF Trust and the persons identified as
   * authors of the code.  All rights reserved.

Pornin                        Informational                    [Page 70]

RFC 6979               Deterministic DSA and ECDSA           August 2013

   * Redistribution and use in source and binary forms, with or without
   * modification, is permitted pursuant to, and subject to the license
   * terms contained in, the Simplified BSD License set forth in Section
   * 4.c of the IETF Trust's Legal Provisions Relating to IETF Documents
   * (http://trustee.ietf.org/license-info).
   * Technical remarks and questions can be addressed to:
   * pornin@bolet.org
   * ------------------------------------------------------------------

  public class DeterministicDSA {

          private String macName;
          private MessageDigest dig;
          private Mac hmac;
          private BigInteger p, q, g, x;
          private int qlen, rlen, rolen, holen;
          private byte[] bx;

           * Create an instance, using the specified hash function.
           * The name is used to obtain from the JVM an implementation
           * of the hash function and an implementation of HMAC.
           * @param hashName   the hash function name
           * @throws IllegalArgumentException  on unsupported name
          public DeterministicDSA(String hashName)
                  try {
                          dig = MessageDigest.getInstance(hashName);
                  } catch (NoSuchAlgorithmException nsae) {
                          throw new IllegalArgumentException(nsae);
                  if (hashName.indexOf('-') < 0) {
                          macName = "Hmac" + hashName;
                  } else {
                          StringBuilder sb = new StringBuilder();
                          int n = hashName.length();
                          for (int i = 0; i < n; i ++) {
                                  char c = hashName.charAt(i);
                                  if (c != '-') {
                          macName = sb.toString();

Pornin                        Informational                    [Page 71]

RFC 6979               Deterministic DSA and ECDSA           August 2013

                  try {
                          hmac = Mac.getInstance(macName);
                  } catch (NoSuchAlgorithmException nsae) {
                          throw new IllegalArgumentException(nsae);
                  holen = hmac.getMacLength();

           * Set the private key.
           * @param p   key parameter: field modulus
           * @param q   key parameter: subgroup order
           * @param g   key parameter: generator
           * @param x   private key
          public void setPrivateKey(BigInteger p, BigInteger q,
                  BigInteger g, BigInteger x)
                   * Perform some basic sanity checks.  We do not
                   * check primality of p or q because that would
                   * be too expensive.
                   * We reject keys where q is longer than 999 bits,
                   * because it would complicate signature encoding.
                   * Normal DSA keys do not have a q longer than 256
                   * bits anyway.
                  if (p == null || q == null || g == null || x == null
                          || p.signum() <= 0 || q.signum() <= 0
                          || g.signum() <= 0 || x.signum() <= 0
                          || x.compareTo(q) >= 0 || q.compareTo(p) >= 0
                          || q.bitLength() > 999
                          || g.compareTo(p) >= 0 || g.bitLength() == 1
                          || g.modPow(q, p).bitLength() != 1) {
                          throw new IllegalArgumentException(
                                  "invalid DSA private key");
                  this.p = p;
                  this.q = q;
                  this.g = g;
                  this.x = x;
                  qlen = q.bitLength();
                  if (q.signum() <= 0 || qlen < 8) {
                          throw new IllegalArgumentException(
                                  "bad group order: " + q);

Pornin                        Informational                    [Page 72]

RFC 6979               Deterministic DSA and ECDSA           August 2013

                  rolen = (qlen + 7) >>> 3;
                  rlen = rolen * 8;

                   * Convert the private exponent (x) into a sequence
                   * of octets.
                  bx = int2octets(x);

          private BigInteger bits2int(byte[] in)
                  BigInteger v = new BigInteger(1, in);
                  int vlen = in.length * 8;
                  if (vlen > qlen) {
                          v = v.shiftRight(vlen - qlen);
                  return v;

          private byte[] int2octets(BigInteger v)
                  byte[] out = v.toByteArray();
                  if (out.length < rolen) {
                          byte[] out2 = new byte[rolen];
                          System.arraycopy(out, 0,
                                  out2, rolen - out.length,
                          return out2;
                  } else if (out.length > rolen) {
                          byte[] out2 = new byte[rolen];
                          System.arraycopy(out, out.length - rolen,
                                  out2, 0, rolen);
                          return out2;
                  } else {
                          return out;

          private byte[] bits2octets(byte[] in)
                  BigInteger z1 = bits2int(in);
                  BigInteger z2 = z1.subtract(q);
                  return int2octets(z2.signum() < 0 ? z1 : z2);


Pornin                        Informational                    [Page 73]

RFC 6979               Deterministic DSA and ECDSA           August 2013

           * Set (or reset) the secret key used for HMAC.
           * @param K   the new secret key
          private void setHmacKey(byte[] K)
                  try {
                          hmac.init(new SecretKeySpec(K, macName));
                  } catch (InvalidKeyException ike) {
                          throw new IllegalArgumentException(ike);

           * Compute the pseudorandom k for signature generation,
           * using the process specified for deterministic DSA.
           * @param h1   the hashed message
           * @return  the pseudorandom k to use
          private BigInteger computek(byte[] h1)
                   * Convert hash value into an appropriately truncated
                   * and/or expanded sequence of octets.  The private
                   * key was already processed (into field bx[]).
                  byte[] bh = bits2octets(h1);

                   * HMAC is always used with K as key.
                   * Whenever K is updated, we reset the
                   * current HMAC key.

                  /* step b. */
                  byte[] V = new byte[holen];
                  for (int i = 0; i < holen; i ++) {
                          V[i] = 0x01;

                  /* step c. */
                  byte[] K = new byte[holen];

                  /* step d. */

Pornin                        Informational                    [Page 74]

RFC 6979               Deterministic DSA and ECDSA           August 2013

                  K = hmac.doFinal();

                  /* step e. */
                  V = hmac.doFinal();

                  /* step f. */
                  K = hmac.doFinal();

                  /* step g. */
                  V = hmac.doFinal();

                  /* step h. */
                  byte[] T = new byte[rolen];
                  for (;;) {
                           * We want qlen bits, but we support only
                           * hash functions with an output length
                           * multiple of 8;acd hence, we will gather
                           * rlen bits, i.e., rolen octets.
                          int toff = 0;
                          while (toff < rolen) {
                                  V = hmac.doFinal();
                                  int cc = Math.min(V.length,
                                          T.length - toff);
                                  System.arraycopy(V, 0, T, toff, cc);
                                  toff += cc;
                          BigInteger k = bits2int(T);
                          if (k.signum() > 0 && k.compareTo(q) < 0) {
                                  return k;

                           * k is not in the proper range; update
                           * K and V, and loop.

Pornin                        Informational                    [Page 75]

RFC 6979               Deterministic DSA and ECDSA           August 2013

                          K = hmac.doFinal();
                          V = hmac.doFinal();

           * Process one more byte of input data (message to sign).
           * @param in   the extra input byte
          public void update(byte in)

           * Process some extra bytes of input data (message to sign).
           * @param in   the extra input bytes
          public void update(byte[] in)
                  dig.update(in, 0, in.length);

           * Process some extra bytes of input data (message to sign).
           * @param in    the extra input buffer
           * @param off   the extra input offset
           * @param len   the extra input length (in bytes)
          public void update(byte[] in, int off, int len)
                  dig.update(in, off, len);

           * Produce the signature.  {@link #setPrivateKey} MUST have
           * been called.  The signature is computed over the data
           * that was input through the {@code update*()} methods.
           * This engine is then reset (made ready for a new
           * signature generation).

Pornin                        Informational                    [Page 76]

RFC 6979               Deterministic DSA and ECDSA           August 2013

           * @return  the signature
          public byte[] sign()
                  return signHash(dig.digest());

           * Produce the signature.  {@link #setPrivateKey} MUST
           * have been called.  The signature is computed over the
           * provided hash value (data is assumed to have been hashed
           * externally).  The data that was input through the
           * {@code update*()} methods is ignored, but kept.
           * If the hash output is longer than the subgroup order
           * (the length of q, in bits, denoted 'qlen'), then the
           * provided value {@code h1} can be truncated, provided that
           * at least qlen leading bits are preserved.  In other words,
           * bit values in {@code h1} beyond the first qlen bits are
           * ignored.
           * @param h1   the hash value
           * @return  the signature
          public byte[] signHash(byte[] h1)
                  if (p == null) {
                          throw new IllegalStateException(
                                  "no private key set");
                  try {
                          BigInteger k = computek(h1);
                          BigInteger r = g.modPow(k, p).mod(q);
                          BigInteger s = k.modInverse(q).multiply(

                           * Signature encoding: ASN.1 SEQUENCE of
                           * two INTEGERs.  The conditions on q
                           * imply that the encoded version of r and
                           * s is no longer than 127 bytes for each,
                           * including DER tag and length.
                          byte[] br = r.toByteArray();
                          byte[] bs = s.toByteArray();
                          int ulen = br.length + bs.length + 4;
                          int slen = ulen + (ulen >= 128 ? 3 : 2);

Pornin                        Informational                    [Page 77]

RFC 6979               Deterministic DSA and ECDSA           August 2013

                          byte[] sig = new byte[slen];
                          int i = 0;
                          sig[i ++] = 0x30;
                          if (ulen >= 128) {
                                  sig[i ++] = (byte)0x81;
                                  sig[i ++] = (byte)ulen;
                          } else {
                                  sig[i ++] = (byte)ulen;
                          sig[i ++] = 0x02;
                          sig[i ++] = (byte)br.length;
                          System.arraycopy(br, 0, sig, i, br.length);
                          i += br.length;
                          sig[i ++] = 0x02;
                          sig[i ++] = (byte)bs.length;
                          System.arraycopy(bs, 0, sig, i, bs.length);
                          return sig;

                  } catch (ArithmeticException ae) {
                          throw new IllegalArgumentException(
                                  "DSA error (bad key ?)", ae);

           * Reset this engine.  Data input through the {@code
           * update*()} methods is discarded.  The current private key,
           * if one was set, is kept unchanged.
          public void reset()

  // ==================================================================

Pornin                        Informational                    [Page 78]

RFC 6979               Deterministic DSA and ECDSA           August 2013

Author's Address

   Thomas Pornin
   Quebec, QC

   EMail: pornin@bolet.org

Pornin                        Informational                    [Page 79]

Html markup produced by rfcmarkup 1.116, available from https://tools.ietf.org/tools/rfcmarkup/