# Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature without Nonce or 'K' when I have private key(priv) and a selected r and an hash of message?

• There is deterministic ECDSA rfc6979 other than this it is not safe. Jan 23, 2022 at 10:17
• r and H(m) are both public knowledge, so based on your understanding, would this be secure? Jan 23, 2022 at 10:18
• @meshcollider no, but I am just askin' if it is possible? Jan 23, 2022 at 10:25
• What is the origin of this question? Jan 23, 2022 at 10:39

Yes, it's normal practice to generate an ECDSA signature from message $$M$$ (or it's hash $$H(M)$$ ), private key $$d_U$$ and curve parameters, without being given a nonce as input. The nonce $$k$$ is built as part of the signing process, in one of two ways:
1. It's generated a secret integer $$k$$ uniformly in $$[1,n)$$ using a true random number generator with secret output. That's the standard definition of ECDSA.
2. It's generated a secret integer $$k$$ in $$[1,n)$$ using a Pseudo Random Function with key $$d_U$$, applied to $$H(M)$$ and optionally other data that needs not be secret (such as a timestamp, or/and a random number). That's what RFC6979 does, prescribing a PRF based on HMAC.
Both methods are as secure: in essence, $$k$$ is a secret in $$[1,n)$$ that, to attackers who do not know the private key $$d_U$$, is unknown and, if it was known, would appear to be random (except for the second option if the same $$M$$ is re-signed and the optional other data repeats or is absent).
The second method has the advantage of not requiring a true random number generator of cryptographic quality. However it uses private key $$d_U$$ (and worse mixes it with variable data potentially known to the adversary), therefore the PRF must be protected against side-channel attacks.