Disallow the zero ECDSA message.
Disallow the zero ECDSA message.

ECDSA has a subtle edge case. If the value to sign is 0, then anyone can forge a signature
by picking (r,s) = (public_key.x, public_key.x).
ref: https://crypto.stackexchange.com/questions/50279/how-should-ecdsa-handle-the-null-hash

Signing is --- working mod n --- supposed to be this:

(x,y) := k*G
r := x
s := inverse(k) * (val + (secret_exponent * r))

and verifying is

u1 := val * inverse(s)
u2 := r * inverse(s)
(x',y') := u1 * G + u2 * public_key
         = (val*inverse(s)) * G + (r * inverse(s)) * public_key

But if val = 0 this collapses to
         = (0*inverse(s)) * G + (r * inverse(s)) * public_key
         = (r * inverse(s)) * public_key

And then as a forger I can lie and pick s := r so that this becomes
         = (r * inverse(r)) * public_key
         = public_key

So I know what value I need r to be to pass verification: r := public_key.x.

So the zero hash is not safe to sign with ECDSA.

The [ecdsa spec](http://www.secg.org/sec1-v2.pdf#subsubsection.4.1.3)
covers a bunch of special cases that don't work (r = 0, s = 0, (x',y') = (0,0))
but it doesn't mention this one.

richardkiss/pycoin,richardkiss/pycoin