nonce: reject maximum RFC6979 attempt #1890

pull l0rinc wants to merge 1 commits into bitcoin-core:master from l0rinc:l0rinc/rfc6979-reject-max-counter changing 2 files +5 −0

l0rinc commented at 9:01 PM on July 14, 2026: contributor

Problem: The RFC6979 nonce callback never returns when called with UINT_MAX. Its unsigned i <= counter loop wraps i to zero after the last iteration. The public callback type accepts this value, and both RFC6979/default callback symbols can be called directly. The ordinary signing loop starts at zero and would need 2^32 retries to reach it, so ordinary signing is unaffected in practice.

Fix: Return 0 for UINT_MAX before initializing RFC6979 state. Smaller counters keep their existing behavior. Add an edge-case assertion that requires the callback to reject the maximum value instead of hanging.

nonce: reject maximum RFC6979 attempt

`nonce_function_rfc6979_impl` generates one candidate for each value from zero through `counter`.
When `counter == UINT_MAX`, incrementing the unsigned loop counter after the last candidate wraps it to zero, so the loop never terminates.

The public callback accepts an unsigned attempt, and both exported nonce callback symbols can be called directly with `UINT_MAX`.
The default signing loop starts at zero and would need `2^32` consecutive retries to reach it, so ordinary signing is unaffected in practice.

Return 0 only for the maximum counter before initializing RFC6979 state, leaving smaller counters unchanged.
Add an edge-case test that requires this value to be rejected instead of hanging.

7b47f1ff01

Contributors

l0rinc