Hello. I was playing around with my Ruby binding for libsecp256k1 today, and I was surprised when I accidentally caused an infinite loop by calling secp256k1_ecdsa_sign. I thought there should at least be a warning in the header file for this, so this pull request is my attempt to write such a warning.
Secret keys that are all zero are considered to be invalid by secp256k1_ec_seckey_verify. The documentation for the seckey argument to secp256k1_ecdsa_sign does say that the secret key is “assumed to be valid”, so the caller would have to be in violation of that rule for the infinite loop to happen. Still, I think there should at least be a warning.
Maybe we should go further though: In an application that allows untrusted user input to be used for the secret key and message hash, this infinite loop could be used in a denial of service attack. One of the goals of the library is to be difficult to use insecurely. Should we take steps to prevent this infinite loop from happening, like implementing a special check to see if both msg32 and seckey are 0, or a having a parameter for the maximum number of nonce-generation attempts before terminating?
