Deterministic Nonce Generation for ECDSA

[julmb]

This adds the main algorithm from RFC 6979, which generates deterministic nonces for ECDSA signing from the private key and the message hash to be signed.

According to RFC 6979 Section 3.3, the nonce generation can be viewed as a result of generating bits using the HMAC_DRBG PRNG from NIST.SP.800-90Ar1. This architecture allows for a more clean separation between the generation of random bits and the usage of those bits for generating a nonce to be used in ECDSA. Thus, I added a new DRG instance HmacDRG in Crypto.Random.HmacDRG.

It was important to me to implement the algorithm from RFC 6979 faithfully and to make sure that the resulting nonces are exactly the same. The RFC contains 150 test cases across 15 curves, 2 messages, and 5 hash functions (see also #44). By making sure that the results are exact, they can be compared to these test cases to gain some confidence in the correctness of the algorithm.

This requirement also meant that I could not use the Crypto.Number.Generate.generateParams function to generate the nonce from a properly initialized HmacDRG, since generateParams takes the bits from the wrong end of a sequence of generated bytes. Because of this, I added the function Crypto.Number.Generate.generatePrefix.

Finally, the function Crypto.PubKey.ECC.ECDSA.deterministicNonce implements the main algorithm. The description in RFC 6979 Section 3.2 contains many technical details about shifting bits, and converting and truncating sequences. It turned out that existing functions like i2ospOf_ and dsaTruncHashDigest implemented most of the required semantics so the final implementation is a lot shorter than the version presented in the RFC.

The function deterministicNonce has the following signature:

deterministicNonce
    :: (HashAlgorithm hashDRG, HashAlgorithm hashDigest)
    => hashDRG -> PrivateKey -> Digest hashDigest -> (Integer -> Maybe a) -> a

The idea is that the parameter with type Integer -> Maybe a is one of the sign*With functions. The algorithm will continue generating nonces until the given sign*With function accepts one and then pass on the result.

[kazu-yamamoto]

This PR conflicts the current main.
Before I start reviewing, would you resolve the conflicts?

[julmb]

I have rebased this onto main.