nx_ecdsa_p256_sign.nx

nx_ecdsa_p256_sign.nx -- ECDSA P-256 signature generation. Companion to nx_ecdsa_p256 (verify, shipped 2026-05-19 with RFC 6979 KAT green). Implements signature GENERATION via RFC 6979 deterministic nonce so the same {priv_key, msg_hash} pair always produces the same (r, s) -- per [[feedback-bits-up-exceed-never-match]] determinism axis. Pure NishiLang composition. No new substrate primitives invented; every step uses an already-shipped op: nx_drbg_hmac -- RFC 6979 HMAC-DRBG for deterministic k nx_p256_scalar_mul -- k * G (the generator) nx_p256_point.to_affine -- normalize R from Jacobian to (x, y) nx_p256_modn -- mod-n arithmetic (add, mul, inv) Algorithm (FIPS 186-5 §6.4.1): Input: private key d (256-bit scalar, 1 <= d < n) message hash e (256-bit, already SHA-256'd by caller) 1. Generate deterministic k via RFC 6979: seed = d_bytes || e_bytes HMAC-DRBG(seed) -> k_bytes; reject if k == 0 or k >= n (in practice for P-256 + SHA-256 + a sane priv key, the first DRBG output is always acceptable) 2. R = k * G (R is a point on the curve) 3. Convert R to affine: get R.x 4. r = R.x mod n (reduce x coordinate into Z/nZ) 5. Reject if r == 0 (probability ~2^-256; if hit, reseed DRBG with extra byte and retry -- caller-visible verdict) 6. s = k^-1 * (e + r * d) mod n 7. Reject if s == 0 (same probability) 8. Return (r, s) as the signature Public API: nx_ecdsa_p256_sign(priv_key: *i64, -- 256-bit scalar d hash_e: *i64, -- 256-bit msg digest out_r: *i64, out_s: *i64) -> verdict Unlocks: