void ecdsa_sign_legacy(ecdsa_signature_t *signature, const ecc_int256_t *hash, const ecc_int256_t *secret) {
  ecc_int256_t hash_r, k, krecip, tmp;
  ecc_25519_work_t kG;
  uint8_t V[32], K[32];

  // Reduce hash (instead of clearing 3 bits)
  ecc_25519_gf_reduce(&hash_r, hash);

  // Generate k
  generate_k_prepare(V, K, secret->p, hash_r.p);

regenerate:
  generate_k(k.p, V, K);
  ecc_25519_gf_sanitize_secret(&k, &k);

  // calculate k^(-1)
  ecc_25519_gf_recip(&krecip, &k);

  // calculate kG = k * base point
  ecc_25519_scalarmult_base(&kG, &k);

  // store x coordinate of kG in r
  ecc_25519_store_xy_legacy(&tmp, NULL, &kG);
  ecc_25519_gf_reduce(&signature->r, &tmp);

  if (ecc_25519_gf_is_zero(&signature->r))
    goto regenerate;

  // tmp = r * secret
  ecc_25519_gf_mult(&tmp, &signature->r, secret);

  // s = hash + tmp = hash + r * secret
  ecc_25519_gf_add(&signature->s, &hash_r, &tmp);

  // tmp = krecip * s = k^(-1) * s
  ecc_25519_gf_mult(&tmp, &krecip, &signature->s);

  // mod n (order of G)
  ecc_25519_gf_reduce(&signature->s, &tmp);

  if (ecc_25519_gf_is_zero(&signature->s))
    goto regenerate;
}
void ecdsa_sign_legacy(ecdsa_signature_t *signature, const ecc_int256_t *hash, const ecc_int256_t *secret) {
  ecc_int256_t hash_r, k, krecip, tmp;
  ecc_25519_work_t kG;
  uint8_t V[32], K[32];

   
  ecc_25519_gf_reduce(&hash_r, hash);

   
  generate_k_prepare(V, K, secret->p, hash_r.p);

regenerate:
  generate_k(k.p, V, K);
  ecc_25519_gf_sanitize_secret(&k, &k);

   
  ecc_25519_gf_recip(&krecip, &k);

   
  ecc_25519_scalarmult_base(&kG, &k);

   
  ecc_25519_store_xy_legacy(&tmp, NULL, &kG);
  ecc_25519_gf_reduce(&signature->r, &tmp);

  if (ecc_25519_gf_is_zero(&signature->r))
    goto regenerate;

   
  ecc_25519_gf_mult(&tmp, &signature->r, secret);

   
  ecc_25519_gf_add(&signature->s, &hash_r, &tmp);

   
  ecc_25519_gf_mult(&tmp, &krecip, &signature->s);

   
  ecc_25519_gf_reduce(&signature->s, &tmp);

  if (ecc_25519_gf_is_zero(&signature->s))
    goto regenerate;
}