hyperledger / hyperledger/fabric-gateway

Support keys other than ECDSA P-256 in HSM signer

Open
#581 0 comments 0 reactions 0 assignees View on GitHub
client enhancement good first issue hacktoberfest
Dominant language
Java
Stars
194
Forks
110
Avg merge
18h 46m
Merged PRs (30d)
42

Description

**As a** blockchain developer
**I want** to be able to use arbitrary key types when signing using a Hardware Security Module (HSM)
**So that** I can use any key type supported by Fabric

In order to ensure that signatures are in canonical format (with low S values), the current Go and Node HSM signer implementations assume that the signing keys in the HSM are P-256 -- or at least that they are elliptic curve keys with the same curve N order as P-256 keys -- to manipulate the signature returned by the HSM. In theory it is possible for other key sizes, curve types or encryption mechanisms to be used.

A more generic solution might be to allow a mapping function to be (optionally) specified when creating the HSM signer, which would be applied to the signature returned by the HSM. The default mapping function would be to ensure the canonical form of a P-256 ECDSA signature (as the code does today), with the user able to specify an appropriate function for whatever keys they use in their HSM.

An additional consideration for the Node implementation is that an appropriately sized pre-allocated Buffer needs to be passed to the call to `C_Sign` (or `C_SignAsync`). This needs to be a suitable size to contain the returned signature so the minimum size is dictated by the type of key used.

Contributor guide

Open the contributing guide

Research direction

Start by locating the Go and Node HSM signer implementations and reviewing how they canonicalize signatures returned by the HSM. Define how an optional signature mapping function and key-dependent Node buffer sizing should work, then verify support for arbitrary Fabric key types, including C_Sign and C_SignAsync paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, node.js
Domain
blockchain, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.