Nonce usage in ECDSA signing algorithm I'm trying to understand the signing function secp256k1_ecdsa_sig_sign(), and I'm curious about the nonce usage here. 

static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) {
  unsigned char b[32];
  secp256k1_gej rp;
  secp256k1_ge r;
  secp256k1_scalar n;
  int overflow = 0;

  secp256k1_ecmult_gen(ctx, &amp;rp, nonce);
  secp256k1_ge_set_gej(&amp;r, &amp;rp);
  secp256k1_fe_normalize(&amp;r.x);
  secp256k1_fe_normalize(&amp;r.y);
  secp256k1_fe_get_b32(b, &amp;r.x);
  secp256k1_scalar_set_b32(sigr, b, &amp;overflow);
  /* These two conditions should be checked before calling */
  VERIFY_CHECK(!secp256k1_scalar_is_zero(sigr));
  VERIFY_CHECK(overflow == 0);

  if (recid) {
    /* The overflow condition is cryptographically unreachable as hitting   it requires finding the discrete log
     * of some P where P.x &gt;= order, and only 1 in about 2^127 points meet this criteria.
     */
     *recid = (overflow ? 2 : 0) | (secp256k1_fe_is_odd(&amp;r.y) ? 1 : 0);
  }
  secp256k1_scalar_mul(&amp;n, sigr, seckey);
  secp256k1_scalar_add(&amp;n, &amp;n, message);
  secp256k1_scalar_inverse(sigs, nonce);
  secp256k1_scalar_mul(sigs, sigs, &amp;n);
  secp256k1_scalar_clear(&amp;n);
  secp256k1_gej_clear(&amp;rp);
  secp256k1_ge_clear(&amp;r);

  if (secp256k1_scalar_is_zero(sigs)) {
    return 0;
  }

  if (secp256k1_scalar_is_high(sigs)) {
    secp256k1_scalar_negate(sigs, sigs);

    if (recid) {
      *recid ^= 1;
    }

  }

  return 1;
}


I'm familiar with the standard ECDSA, but what exactly is being done with the nonce here and why?

Thanks!
Answered by Pieter Wuille in comments:


  That's just ECDSA. The nonce is the randomness for the signature, and has nothing to do with the message being signed. An ECDSA signature is a pair (r,s) where r is the X coordinate of kG, and s = (m+r*x)/k (where k=nonce, m=message hash, x=private key, G=curve generator).