In creating a scriptSig, how do I sign the hash of a raw transaction?

Question

I have created a raw transaction, added the hash code, and Double-sha256 this result. Now I should sign this hash with the private key, which would give me the DER encoded signature, but I'm not clear on what exactly I should be doing. How do I SIGN this hash with the private key? What exactly would I be doing? I am not using any crypto library, except for SHA256, and I have implemented secp256k1 my self, so I guess in relation to that, what should I be doing with the private key and the hash? I am specifically aimed at step 15. If I were to guess, this and this are essentially my answer, unless I am mistaken, and if I am, I would like to know why. Otherwise, the caveat with those answers is the introduction of a random nonce. Why could I not just have the private key = "k" (since you shouldn't reuse addresses anyway, right?), calculate "s", and concatenate "r" and "s"? Or is this how it IS done?

Answer 1

It is not the sha256(sha256(tx_bytes)) that needs to be signed. You need to follow the specific algorithm defined inside of Bitcoin core to produce a proper digital signature. Here is where the signature encoding algorithm is defined. Notice, that this algorithm changes slightly based on the hash type you provide. This allows us functionality to include (or prevent inclusion) of extra inputs/outputs on a transaction.

Answer 2

This would be the answer I am looking for, with a helper link for the first function (signature generation algorithm), and a helper link for the second function (rfc6979 standard for generating "k"):

def ecdsa_sign(val, secret_exponent):
    """Return a signature for the provided hash, using the provided
    random nonce. It is absolutely vital that random_k be an unpredictable
    number in the range [1, self.public_key.point.order()-1].  If
    an attacker can guess random_k, he can compute our private key from a
    single signature. Also, if an attacker knows a few high-order
    bits (or a few low-order bits) of random_k, he can compute our private
    key from many signatures. The generation of nonces with adequate
    cryptographic strength is very difficult and far beyond the scope
    of this comment.
May raise RuntimeError, in which case retrying with a new
random value k is in order.
"""
G = ecdsa.SECP256k1
n = G.order()
k = deterministic_generate_k(n, secret_exponent, val)
p1 = k * G
r = p1.x()
if r == 0: raise RuntimeError("amazingly unlucky random number r")
s = ( ecdsa.numbertheory.inverse_mod( k, n ) * ( val + ( secret_exponent * r ) % n ) ) % n
if s == 0: raise RuntimeError("amazingly unlucky random number s")

return signature_to_der(r, s)


def deterministic_generate_k(generator_order, secret_exponent, val, hash_f=hashlib.sha256):
    """
    Generate K value according to https://www.rfc-editor.org/rfc/rfc6979
    """
    n = generator_order
    order_size = (bit_length(n) + 7) // 8
    hash_size = hash_f().digest_size
    v = b'\x01' * hash_size
    k = b'\x00' * hash_size
    priv = intbytes.to_bytes(secret_exponent, length=order_size)
    shift = 8 * hash_size - bit_length(n)
    if shift > 0:
        val >>= shift
    if val > n:
        val -= n
    h1 = intbytes.to_bytes(val, length=order_size)
    k = hmac.new(k, v + b'\x00' + priv + h1, hash_f).digest()
    v = hmac.new(k, v, hash_f).digest()
    k = hmac.new(k, v + b'\x01' + priv + h1, hash_f).digest()
    v = hmac.new(k, v, hash_f).digest()
while 1:
    t = bytearray()

    while len(t) < order_size:
         v = hmac.new(k, v, hash_f).digest()
         t.extend(v)

    k1 = intbytes.from_bytes(bytes(t))

    k1 >>= (len(t)*8 - bit_length(n))
    if k1 >= 1 and k1 < n:
        return k1

    k = hmac.new(k, v + b'\x00', hash_f).digest()
    v = hmac.new(k, v, hash_f).digest()

Answer 3

what should I be doing with the private key and the hash?

sign :)

there is such method in any crypto-lib

for more information refer to Redeeming a raw transaction step by step example required step #15