// PartialSign is the generalized and exported version of
// schnorrPartialSign.
func PartialSign(curve *secp256k1.KoblitzCurve, msg []byte,
	priv *secp256k1.PrivateKey, privNonce *secp256k1.PrivateKey,
	pubSum *secp256k1.PublicKey) (*Signature, error) {
	privBytes := priv.Serialize()
	defer zeroSlice(privBytes)
	privNonceBytes := privNonce.Serialize()
	defer zeroSlice(privNonceBytes)

	return schnorrPartialSign(curve, msg, privBytes, privNonceBytes, pubSum,
		chainhash.HashFuncB)
}

// GenerateNoncePair is the generalized and exported version of generateNoncePair.
func GenerateNoncePair(curve *secp256k1.KoblitzCurve, msg []byte,
	privkey *secp256k1.PrivateKey, extra []byte,
	version []byte) (*secp256k1.PrivateKey, *secp256k1.PublicKey, error) {
	priv, pubNonce, err := generateNoncePair(curve, msg, privkey.Serialize(),
		nonceRFC6979, extra, version)
	if err != nil {
		return nil, nil, err
	}

	privNonce := secp256k1.NewPrivateKey(curve,
		EncodedBytesToBigInt(copyBytes(priv)))
	return privNonce, pubNonce, nil
}

// Sign is the exported version of sign. It uses RFC6979 and Blake256 to
// produce a Schnorr signature.
func Sign(curve *secp256k1.KoblitzCurve, priv *secp256k1.PrivateKey,
	hash []byte) (r, s *big.Int, err error) {
	// Convert the private scalar to a 32 byte big endian number.
	pA := BigIntToEncodedBytes(priv.GetD())
	defer zeroArray(pA)

	// Generate a 32-byte scalar to use as a nonce. Try RFC6979
	// first.
	kB := nonceRFC6979(priv.Serialize(), hash, nil, nil)

	for {
		sig, err := schnorrSign(curve, hash, pA[:], kB, nil, nil,
			chainhash.HashFuncB)
		if err == nil {
			r = sig.GetR()
			s = sig.GetS()
			break
		}

		errTyped, ok := err.(SchnorrError)
		if !ok {
			return nil, nil, fmt.Errorf("unknown error type")
		}
		if errTyped.GetCode() != ErrSchnorrHashValue {
			return nil, nil, err
		}

		// We need to compute a new nonce, because the one we used
		// didn't work. Compute a random nonce.
		_, err = rand.Read(kB)
		if err != nil {
			return nil, nil, err
		}
	}

	return r, s, nil
}