Secure Signing e2e Integration #993

l-monninger · 2025-01-10T09:32:52Z

Summary

RFCs: \emptyset$.
Categories: misc.

Integrates secure signing work and prepares e2e testing.

To facilitate e2e testing, a common Identifier is used to render a LoadedSigner struct, which currently wraps any of the HashiCropVault, AwsKms, or Local signers provided here.
An example usage of loading the a Secp256k1 signer from the Config into the DA Light Node is implemented here.
Required next steps are the successful updates and replacements of MAPTOS_PRIVATE_KEY, MCR_SETTLEMENT_KEY, and MOVEMENT_DA_SIGNER to match the canonical string serialization here, s.t. the overlay runs and can toggel different backends. The overlay will then be expanded upon.

Changelog

Testing

Outstanding issues

…sxyz/movement into hsm/signapi

Provide From conversion impls to construct PrivateKey and Signature from byte arrays. The conversions into PrivateKey are fallible, while a Signature is allowed to be constructed from any 64 bytes.

Add TestSigner providing an in-process Signing implementation for tests.

TryFromBytes is not needed, neither is the public key as a member of HashiCorpVault state.

…yz/movement into musitdev/alloy-integration

mzabaluev · 2025-01-16T17:14:51Z

protocol-units/da/movement/celestia/light-node/src/v1/passthrough.rs

 	pub verifier: Arc<
 		Box<dyn VerifierOperations<CelestiaBlob, IntermediateBlobRepresentation> + Send + Sync>,
 	>,
-	pub signing_key: SigningKey<C>,
+	pub signer: Arc<Signer<O, C>>,


So we're punting the blob signature curve choice as a generic parameter up to here, but the VerifierOperations trait does not fix it, so...

mzabaluev · 2025-01-16T17:16:34Z

protocol-units/da/movement/celestia/light-node/src/v1/passthrough.rs


 		Ok(Self {
 			config: config.clone(),
 			celestia_namespace: config.celestia_namespace(),
 			default_client: client.clone(),
-			verifier: Arc::new(Box::new(Verifier::<C>::new(
+			verifier: Arc::new(Box::new(Verifier::<Secp256k1>::new(


... so this concrete implementation is responsible for hooking the verifier with the correct curve choice.

Co-authored-by: Mikhail Zabaluev <[email protected]> Co-authored-by: Liam Monninger <[email protected]>

mzabaluev · 2025-01-27T15:59:49Z

The sec256k1::send_tx test fails.

Co-authored-by: Richard Melkonian <[email protected]> Co-authored-by: Icarus131 <[email protected]> Co-authored-by: primata <[email protected]> Co-authored-by: musitdev <[email protected]> Co-authored-by: Andy Golay <[email protected]> Co-authored-by: Icarus131 <[email protected]> Co-authored-by: Mikhail Zabaluev <[email protected]>

Co-authored-by: Mikhail Zabaluev <[email protected]>

andygolay · 2025-01-28T22:36:39Z

The sec256k1::send_tx test fails.

I saw I was pinged for a review.

What is the command for running this and the other tests? I see the tests in util/signing/testing/tests but haven't managed to run them yet with various attempted commands.

Also does util/signing/testing needed to be added to the workspace.members array in the root Cargo.toml? noticed it's not in there. I got an error about it with one test command I tried.

l-monninger and others added 30 commits December 17, 2024 10:38

fix: messing around.

d842b40

fix: google and amazon.

642227e

Server for HSM demo (#962)

873d1ff

feat: generics for cryptography.

df28163

fix: hsm demo CLI.

2093ac1

first draf of the API

8477374

correct get_public_key call

37cfc8e

add error to sign API

7ba55d9

set API function pub

50bbc98

fix: structuring.

dfa32da

Merge branch 'l-monninger/hsm-demo' of https://github.com/movementlab…

14fef3c

…sxyz/movement into hsm/signapi

chore: scaffold signing api.

2f5636f

Alloy signing integration

e461221

feat(signing): byte array conversions for ed25519

653adf7

Provide From conversion impls to construct PrivateKey and Signature from byte arrays. The conversions into PrivateKey are fallible, while a Signature is allowed to be constructed from any 64 bytes.

feat(signing): movement-signer-test crate

53e08b7

Add TestSigner providing an in-process Signing implementation for tests.

simple transfer test for AWS signing

43c974b

refactor(signing): no need for custom trait

7929c21

TryFromBytes is not needed, neither is the public key as a member of HashiCorpVault state.

test(signing): test TestSigner

a50bf0e

chore: clean up unused rand_core dep

ca1ffac

adapte AWS provider to new API version

436b21b

use AwsKmsCryptography trait

ca9c370

rename new to try_new

1f522d5

correct build

7f6c6b3

add rustls-tls to allow https connections

4d6faa8

correct Cargo.lock file

7ad333d

Merge branch 'musitdev/alloy-integration' of github.com:movementlabsx…

a8ae7d1

…yz/movement into musitdev/alloy-integration

test(signing): Add executor test for signed transactions

82b7b68

test: add signer tests to the unit-tests workflow

0018145

feat: key standard.

a2439bb

feat: create key.

99875dc

mzabaluev reviewed Jan 16, 2025

View reviewed changes

l-monninger and others added 22 commits January 17, 2025 09:30

fix: working through refactor.

d78b8bf

fix: serialization and deserialization.

d530ba3

chore: supported curves serialization and deserialization.

0ec5f5c

fix: refactor.

112cd64

chore: logging for loader.

a27e65b

Secure signing: Key rotation with CLI (#1002)

ff49b15

Signing: Settlement signing integration (#995)

3d971c6

Co-authored-by: Mikhail Zabaluev <[email protected]> Co-authored-by: Liam Monninger <[email protected]>

fix: change VAULT_ADDRESS to VAULT_ADDR

a669be2

fix: injective mapping with different delineators for aws and vault

9c415ad

fix: default to uncompressed bytes.

309df7a

fix: ensure vault test readability.

7ca2d9f

fix: merge.

c238379

fix: merge.

7596d3f

fix: add key roation subcommand.

f47ce67

fix: add key roation subcommand.

3e873e8

fix: stash.

31827be

fix: stash.

280c548

fix: aptos signer e2e test.

c92884d

Mainnet Target Branch (#1017)

9bdabaf

fix: framework.

1900145

fix: add mint lock.

8e3b690

fix: add governed gas pool ops.

87c68d6

mzabaluev mentioned this pull request Jan 27, 2025

SignerIdentifier::try_raw_private_key #1019

Merged

l-monninger requested a review from andygolay as a code owner January 28, 2025 21:20

l-monninger and others added 2 commits January 28, 2025 13:26

Config Migration (#1024)

2b62a93

Co-authored-by: Mikhail Zabaluev <[email protected]>

SignerIdentifier::try_raw_private_key (#1019)

2407bd9

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Secure Signing e2e Integration #993

Secure Signing e2e Integration #993

l-monninger commented Jan 10, 2025

mzabaluev Jan 16, 2025

mzabaluev Jan 16, 2025

mzabaluev commented Jan 27, 2025

andygolay commented Jan 28, 2025

Secure Signing e2e Integration #993

Are you sure you want to change the base?

Secure Signing e2e Integration #993

Conversation

l-monninger commented Jan 10, 2025

Summary

Changelog

Testing

Outstanding issues

mzabaluev Jan 16, 2025

Choose a reason for hiding this comment

mzabaluev Jan 16, 2025

Choose a reason for hiding this comment

mzabaluev commented Jan 27, 2025

andygolay commented Jan 28, 2025