Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing
[message | private key] to calculate $k$ for deterministic ECDSA?
If the resulting $k$ or the signature is invalid, then a known byte value can be appended to the input, and re-hashed, until an acceptable result is achieved:
k=h([message|privateKey|0x00 … 0x00])
0x00 bytes as the number of iterations it takes.
Am I missing an inherent weakness here?
Edit: If the hash function output length is smaller than the curve order, multiple hash outputs (produced by appending a known byte, similar to what was described above) can be concatenated as necessary:
k=[ h([message|privateKey]) | h([message|privateKey|0x00]) ... ]
Once you have enough output, you can then truncate it to match the curve order bit length.
And if the resulting $k$ or the signature is no good, then restart with the known byte appended:
k=[ h([message|privateKey|0x00]) | h([message|privateKey|0x00 0x00]) ... ]
And so on, until an acceptable $k$ is produced.