Function dsig_chain_block 

pub fn dsig_chain_block(
    secret: &[u8; 18],
    nonce: &[u8; 16],
    index: usize,
    depth: usize,
) -> [u8; 64]

Builds DSig’s 64-byte chain block with wrapping low-32-bit nonce salt.

Layout: nonce (16 bytes), secret (18 bytes), zero padding (30 bytes). Only nonce bytes 0..4 change: their little-endian value adds index + 68 * depth modulo 2^32. There is no carry into nonce byte four. This low-level oracle deliberately accepts all indices/depths; the WOTS protocol must separately enforce index < 68 and its legal chain depth.

 byte  0    4          16              34                          64
       ├────┼──────────┼───────────────┼───────────────────────────┤
       │salt│ nonce    │ secret (node) │  30 zero bytes            │
       │ed  │ 4..16    │ 18 bytes      │                           │
       └────┴──────────┴───────────────┴───────────────────────────┘
  bytes 0..4 = (nonce[0..4] as u32 LE) + index + 68·depth   (mod 2^32)

Why salt at all: adding index + 68·depth makes every (chain, step) pair hash a block with a different prefix, so no two hash calls in one key share an input shape. index is the chain number (0..68) and depth is how far along the chain the step is.