Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CODEOWNERS
Original file line number Diff line number Diff line change
@@ -1 +1,3 @@
* @welthee/backend

@0xSyndr
25 changes: 17 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,21 +10,24 @@ offered by the official go-ethereum library.
## Import

```go
import "github.com/welthee/go-ethereum-aws-kms-tx-signer/v2"
import "github.com/0xSyndr/go-ethereum-aws-kms-tx-signer/v2"
```

## Usage

In order to sign Ethereum transactions with an AWS KMS key you need to create a KMS key in AWS, and grant your
application's principal access to use it.

Then, modify your Ethereum transactor code to use the `bind.TransactOpts` that this library returns.

### Create an AWS KMS key

Create an AWS KMS Assymetric key with key usage of `SIGN_VERIFY` and spec `ECC_SECG_P256K1`. Make sure that you add an
appropriate key policy granting your code the following permissions:
`kms:GetPublicKey`, `kms:Sign`.

Example key policy:

```json
{
"Sid": "AllowSignAndGetPublicKey",
Expand All @@ -37,17 +40,16 @@ Example key policy:
"arn:aws:iam::444455556666:root"
]
},
"Action": [
"kms:Sign",
"kms:GetPublicKey"
]
"Action": ["kms:Sign", "kms:GetPublicKey"]
}
```

### Your transactor code

The `abigen` tool generates bindings that are able to directly operate with the `*bind.TransactOpts` type.

For instance an IERC20 transactor integrated with the KMS signer would look like this:

```go
var client *ethclient.client
var kmsSvc *kms.KMS
Expand All @@ -60,18 +62,25 @@ transactOpts := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, ch

tx, err := transactor.Transfer(transactOpts, toAddress, big.NewInt(amountInt))
```

Note how the `ethawskmssigner.NewAwsKmsTransactorWithChainID(...)` returns a ready to use `*bind.TransactOpts`.

In order to use in manually constructed transactions, you can use the Signer to sign your transaction yourself.
Example:

```go
transactOpts, _ := ethawskmssigner.NewAwsKmsTransactorWithChainID(kmsSvc, keyId, clChainId)
tx := types.NewTransaction(nonce, toAddress, value, gasLimit, gasPrice, nil)
signedTx, _ := transactOpts.Signer(transactOpts.From, tx)
err = client.SendTransaction(context.TODO(), signedTx)
```

# See also

- [typed_data_signer_test.go](./typed_data_signer_test.go) for an example of how to sign typed data.

# Further reading
* [Signing and Verifying Ethereum Signatures](https://yos.io/2018/11/16/ethereum-signatures/)
* [EIP-155: Simple replay attack protection](https://eips.ethereum.org/EIPS/eip-155)
* [The Dark Side of the Elliptic Curve - Signing Ethereum Transactions with AWS KMS in JavaScript](https://luhenning.medium.com/the-dark-side-of-the-elliptic-curve-signing-ethereum-transactions-with-aws-kms-in-javascript-83610d9a6f81)

- [Signing and Verifying Ethereum Signatures](https://yos.io/2018/11/16/ethereum-signatures/)
- [EIP-155: Simple replay attack protection](https://eips.ethereum.org/EIPS/eip-155)
- [The Dark Side of the Elliptic Curve - Signing Ethereum Transactions with AWS KMS in JavaScript](https://luhenning.medium.com/the-dark-side-of-the-elliptic-curve-signing-ethereum-transactions-with-aws-kms-in-javascript-83610d9a6f81)
58 changes: 36 additions & 22 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,43 +1,57 @@
module github.com/welthee/go-ethereum-aws-kms-tx-signer/v2
module github.com/0xSyndr/go-ethereum-aws-kms-tx-signer

go 1.20

require (
github.com/aws/aws-sdk-go-v2 v1.20.0
github.com/aws/aws-sdk-go-v2/config v1.18.32
github.com/aws/aws-sdk-go-v2 v1.21.2
github.com/aws/aws-sdk-go-v2/config v1.18.45
github.com/aws/aws-sdk-go-v2/service/kms v1.24.1
github.com/ethereum/go-ethereum v1.12.0
github.com/ethereum/go-ethereum v1.13.5
github.com/pkg/errors v0.9.1
github.com/stretchr/testify v1.8.4
)

require (
github.com/VictoriaMetrics/fastcache v1.10.0 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.13.31 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.7 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.37 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.31 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.3.38 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.31 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.13.1 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.15.1 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.21.1 // indirect
github.com/aws/smithy-go v1.14.0 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.13.43 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.15.2 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.23.2 // indirect
github.com/aws/smithy-go v1.15.0 // indirect
github.com/bits-and-blooms/bitset v1.7.0 // indirect
github.com/btcsuite/btcd/btcec/v2 v2.2.0 // indirect
github.com/consensys/bavard v0.1.13 // indirect
github.com/consensys/gnark-crypto v0.12.1 // indirect
github.com/crate-crypto/go-kzg-4844 v0.7.0 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/deckarep/golang-set/v2 v2.1.0 // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 // indirect
github.com/ethereum/c-kzg-4844 v0.4.0 // indirect
github.com/fsnotify/fsnotify v1.6.0 // indirect
github.com/gballet/go-libpcsclite v0.0.0-20191108122812-4678299bea08 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
github.com/go-stack/stack v1.8.1 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/gorilla/websocket v1.5.0 // indirect
github.com/holiman/uint256 v1.2.2-0.20230321075855-87b91420868c // indirect
github.com/mattn/go-runewidth v0.0.13 // indirect
github.com/holiman/uint256 v1.2.3 // indirect
github.com/mmcloughlin/addchain v0.4.0 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/shirou/gopsutil v3.21.11+incompatible // indirect
github.com/tklauser/go-sysconf v0.3.10 // indirect
github.com/tklauser/numcpus v0.5.0 // indirect
github.com/supranational/blst v0.3.11 // indirect
github.com/tklauser/go-sysconf v0.3.12 // indirect
github.com/tklauser/numcpus v0.6.1 // indirect
github.com/yusufpapurcu/wmi v1.2.2 // indirect
golang.org/x/crypto v0.1.0 // indirect
golang.org/x/sys v0.7.0 // indirect
gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
golang.org/x/crypto v0.17.0 // indirect
golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
golang.org/x/mod v0.12.0 // indirect
golang.org/x/sync v0.3.0 // indirect
golang.org/x/sys v0.15.0 // indirect
golang.org/x/tools v0.13.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
rsc.io/tmplfunc v0.0.3 // indirect
)
Loading