welthee / go-ethereum-aws-kms-tx-signer

Ethereum transaction signer using AWS KMS keys. An extension for the go ethereum client library.

AWS KMS transaction signer for go-ethereum

At welthee we are using AWS KMS managed private keys to sign Ethereum transactions.

This little package eases integration with AWS KMS in your GoLang Ethereum project, by extending the functionality offered by the official go-ethereum library.

Import

import "github.com/welthee/go-ethereum-aws-kms-tx-signer/v2"

Usage

In order to sign Ethereum transactions with an AWS KMS key you need to create a KMS key in AWS, and grant your application's principal access to use it.

Then, modify your Ethereum transactor code to use the bind.TransactOpts that this library returns.

Create an AWS KMS key

Create an AWS KMS Assymetric key with key usage of SIGN_VERIFY and spec ECC_SECG_P256K1. Make sure that you add an appropriate key policy granting your code the following permissions: kms:GetPublicKey, kms:Sign.

Example key policy:

{
  "Sid": "AllowSignAndGetPublicKey",
  "Effect": "Allow",
  "Resource": "*",
  "Principal": {
    "AWS": [
      "arn:aws:iam::111122223333:user/CMKUser",
      "arn:aws:iam::111122223333:role/CMKRole",
      "arn:aws:iam::444455556666:root"
    ]
  },
  "Action": [
    "kms:Sign",
    "kms:GetPublicKey"
  ]
}

Your transactor code

The abigen tool generates bindings that are able to directly operate with the *bind.TransactOpts type.

For instance an IERC20 transactor integrated with the KMS signer would look like this:

var client *ethclient.client
var kmsSvc *kms.KMS
var chainID *big.Int
var erc20Address common.Address

transactor, _ := internal.NewIERC20Transactor(erc20Address, client)

transactOpts := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, chainId)

tx, err := transactor.Transfer(transactOpts, toAddress, big.NewInt(amountInt))

Note how the ethawskmssigner.NewAwsKmsTransactorWithChainID(...) returns a ready to use *bind.TransactOpts.

In order to use in manually constructed transactions, you can use the Signer to sign your transaction yourself. Example:

transactOpts, _ := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, clChainId)
tx := types.NewTransaction(nonce, toAddress, value, gasLimit, gasPrice, nil)
signedTx, _ := transactOpts.Signer(transactOpts.From, tx)
err = client.SendTransaction(context.TODO(), signedTx)

Further reading

• Signing and Verifying Ethereum Signatures
• EIP-155: Simple replay attack protection
• The Dark Side of the Elliptic Curve - Signing Ethereum Transactions with AWS KMS in JavaScript

go-ethereum-aws-kms-tx-signer's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update all non-major golang dependencies (github.com/aws/aws-sdk-go-v2, github.com/aws/aws-sdk-go-v2/config, github.com/aws/aws-sdk-go-v2/service/kms, github.com/ethereum/go-ethereum)
• chore(deps): update actions/checkout action to v4

Detected dependencies

github-actions

.github/workflows/main.yml

• actions/checkout v3

gomod

go.mod

• go 1.20
• github.com/aws/aws-sdk-go-v2 v1.20.0
• github.com/aws/aws-sdk-go-v2/config v1.18.32
• github.com/aws/aws-sdk-go-v2/service/kms v1.24.1
• github.com/ethereum/go-ethereum v1.12.0
• github.com/pkg/errors v0.9.1

---

• Check this box to trigger a request for Renovate to run again on this repository

Invalid signature length issue

I have noticed when signing a large amount of transactions sometimes an invalid signature length of 64 is generated which returns an error from secp256.go checkSignature function.
Is this a known issue?