Corrected BIP-340 step numbering in BIP340Signer signing comments, relates to github #2340.

The submitted fix folded the separate rand and k' spec steps into one, over-shifting the R/k and e/sig labels that were already correct; numbering now matches the BIP-340 bullet order.

Author: dghgit

CONTRIBUTORS.html

@@ -593,6 +593,7 @@
 <li>Bernd Pr&uuml;nster (A-SIT Plus) &lt;bernd.pruenster&#064;a-sit.at&gt; - reported lenient ASN.1 UTCTime/GeneralizedTime parsing accepting structurally malformed content, with fuzzing-derived test cases.</li>
 <li>rootvector2 &lt;https://github.com/rootvector2&gt; - constant time comparison of membership and confirmation tags in the MLS API. Reported unbounded array allocation in the BKS/UBER keystore load path (OutOfMemoryError DoS from a crafted keystore) and introduction of a capped decompression limit in PGPCompressedData.getDataStream(), both with POC. Original submission creating S/MIME backing temp files with owner-only permissions (PR #2326). Rejecting empty sequences in the X.509 extension parsers whose RFC 5280 syntax is SEQUENCE SIZE (1..MAX) - CRLDistPoint, CertificatePolicies, ExtendedKeyUsage, PolicyMappings, and SubjectDirectoryAttributes (PR #2331).</li>
 <li>suraj0208 &lt;https://github.com/suraj0208&gt; - initial work on auto-detecting private key reader (JcaPrivateKeyReader).</li>
+<li>liamgilligan &lt;https://github.com/liamgilligan&gt; - noticing the BIP-340 step numbering in the BIP340Signer signing comments was incorrect (PR #2340).</li>
 </ul>
 </body>
 </html>

core/src/main/java/org/bouncycastle/crypto/signers/BIP340Signer.java

@@ -206,7 +206,7 @@ private static byte[] sign(ECPrivateKeyParameters privateKey, byte[] m, byte[] a
     {
         BigInteger n = SECP256K1.getN();
 
-        // Step 1: d' = int(sk); fail if d' = 0 or d' >= n.
+        // Steps 1-2: d' = int(sk); fail if d' = 0 or d' >= n.
         BigInteger d = privateKey.getD();
         if (d.signum() <= 0 || d.compareTo(n) >= 0)
         {
@@ -215,15 +215,15 @@ private static byte[] sign(ECPrivateKeyParameters privateKey, byte[] m, byte[] a
 
         ECMultiplier mult = new FixedPointCombMultiplier();
 
-        // Steps 4-5: P = d' * G; d = d' if has_even_y(P) else n - d'.
+        // Steps 3-4: P = d' * G; d = d' if has_even_y(P) else n - d'.
         ECPoint P_pt = mult.multiply(SECP256K1.getG(), d).normalize();
         if (!hasEvenY(P_pt))
         {
             d = n.subtract(d);
         }
         byte[] pBytes = xBytes(P_pt);
 
-        // Steps 6-8: t = bytes(d) XOR H_aux(a); k' = int(H_nonce(t || bytes(P) || m)) mod n; fail if k' = 0.
+        // Steps 5-8: t = bytes(d) XOR H_aux(a); k' = int(H_nonce(t || bytes(P) || m)) mod n; fail if k' = 0.
         byte[] t = BigIntegers.asUnsignedByteArray(X_SIZE, d);
         Bytes.xorTo(X_SIZE, taggedHash(TAG_HASH_AUX, auxRand), t);