Open in app

Sign in

Write

Sign in

Tezos on KMS

Keefer Taylor
Coinmonks
Published in
4 min readSep 21, 2020

--

By Keefer Taylor and Luke Youngblood

Today, we’re open sourcing two libraries for working with Tezos keys stored in Amazon Web Service’s Key Management System (“AWS KMS”). These tools provide a security focused abstraction that allows developers to securely work with hot keys stored in the cloud.

Photo by Jan Antonin Kolar on Unsplash

About KMS

Before discussing the new libraries, some background on KMS may be useful.

AWS KMS is a cloud solution which provides hardware security modules (HSMs) on demand. HSMs are computer hardware that is hard wired to not allow key extraction. AWS KMS provides redundant and secure access to these keys across multiple geographic regions, while preventing key extraction or theft by rogue employees or malicious attackers.

KMS recently began to support the secp256k1 signing curving, which is used in Tezos and other cryptocurrencies. This development makes AWS KMS an enticing solution for securing keys which need to be online, highly available, and secure. Best of all, the service is cheap, costing only a few dollars a month to store and use a key.

Use in Harbinger Infrastructure

Harbinger price oracles (a secure on chain price feed) make use of AWS KMS extensively. Signers for Harbinger data feeds store their keys in KMS, where they are used to sign data feeds. The poster for Harbinger data on Tezos mainnet stores funds and signs and pays for an operation once an hour. For those curious, Keefer Taylor and Luke Youngblood talk extensively about how KMS is utilized in the Harbinger system in TezTalks 11.

Both of these services secure non-trivial amounts of value. In the signer’s case, malicious users could alter the price feed potentially affecting outcomes of DeFi instruments with arbitrarily high amounts of losses. In the poster’s case, live funds are secured on a hot wallet. Both services also require keys to be online constantly (to sign data feeds on demand in the case of the signer, or to pay for updates to the oracles in the case of the poster). KMS represents a secure solution that allows both of these services to function.

Generalized KMS Libraries

KMS proves to be a very useful and service to store Tezos keys, and we think other developers may find value in using this infrastructure for their own DeFi projects or services running on Tezos. We’ve generalized and extracted two TypeScript packages from the Harbinger infrastructure for re-use.

Tezos-KMS

The first package, Tezos-KMS, is targeted at Tezos developers who want a secure solution to store keys and sign arbitrary bytes.

The library provides a wrapper around a KMS key which allows retrieval of a public key, public key hash, and allows the key to sign arbitrary bytes. This library is modular, simple to use and easy to understand. Here’s a brief example of how to get started:

const kmsClient = new TezosKmsClient(awsKeyId, awsRegion)await kmsClient.getPublicKey() // sppk…
await kmsClient.getPublicKeyHash() // tz2…await kmsClient.signOperation(Buffer.from(‘deadbeef’, ‘hex’)) // <bytes>await kmsClient.signOperationBase58(Buffer.from(‘deadbeef’, ‘hex’)) // spsig…

Conseil-KMS

The second package, Conseil-KMS, provides plug and play functionality for using Cryptonomic’s ConseilJS. ConseilJS provides modular interfaces for signing operations (called Signers) and working with keys (called Keystores).

Conseil-KMS provides an implementation of a Signer and KeyStore which is backed by a key stored in KMS. A developer using Conseil only needs to instantiate these new implementations and provide them to ConseilJS for use in operations. Here’s a quick example:

const signer = new KmsSigner(awsKeyId, awsRegion)
const keystore = KmsKeyStore.from(awsKeyId, awsRegion)// This is a vanilla Conseil invocation with no 
// modification requiredconst result = await TezosNodeWriter.sendTransactionOperation(
 “https://rpctest.tzbeta.net", 
 signer, 
 keystore, 
 ‘tz1RVcUP9nUurgEJMDou8eW3bVDs6qmP5Lnc’, // Recipient
 500000, // Amount, in mutez
 1500 // Fee, in mutez
)

Conclusion

AWS KMS provides a compelling and secure solution for enterprise grade dApps and services who need hot, secure, and redundant key access for high value services.

These new libraries provide generic and reuseable interfaces for all Tezos developers. We look forward to continuing to build useful DeFi primitives and infrastructure for the Tezos ecosystem and welcome contributions, and feedback. Developers can check out the source code, fork or contribute to these libraries in their respective GitHub repos:

Also, Read

Tezos
Cryptocurrency
Xtz
AWS
Aws Kms

--

--

Keefer Taylor
Coinmonks

Written by Keefer Taylor

45 Followers

CEO, Tessellated Geometry / www.TessellatedGeometry.com

Help

Status

About

Careers

Press

Blog

Privacy

Terms

Text to speech

Teams