I recently started reading RFC 6979. I'm curious why it needs so many loops.

This post asks a similar question: "RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?", but my doubts are still unanswered.

Why can't the $k$ used in ECDSA be just like $k = SHA256(sk + HASH(m))$ ?

Is it just because HMAC_DRBG has a better security proof ?


1 Answer 1


The existing security proofs for DSA and ECDSA require k to be chosen uniformly at random. HMAC_DRBGB is already an approved CSPRNG for use in either signature scheme. So this just changes the instantiation and entropy source, making it a minimal change for existing implementations to add. See section 3.5, "Rationale"


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.