Integrating KMS with ethers _signTypedData (EIP712)

Question

I am trying to integrate KMS (Amazon) with ethers for signing the typedData and verify the signer in the smart contract.

Before :

The private key was saved as environment variable. Since it could be a security issue and potentially lose funds locked in it. Also the signer is the owner of the smart contract.

Present :

Instead of signing the msg with the private key stored in the server, i want to sign the data using the private key stored in KMS. I have integrated KMS before for signing a transaction and sending, however i am unsure how to go about for the typed data.

Code snippet - Original one with ethers

  const { ethers }   = require("ethers"); 
  let privateKey = "";
  let signer = new ethers.Wallet(privateKey); 

  let signature = await signer._signTypedData( {
  name: "name",
  version: "1.0.0",
  chainId: 4,
  verifyingContract: ""
},
{
  Request: [
    {
      name: "id",
      type: "string",
    },
    {
      name: "amount",
      type: "uint256",
    },
    {
      name: "wallet",
      type: "address",
    },
  ],
},
{
  id: "id",
  amount: 1,
  wallet: ""
});

OUTPUT :

Signature sample output :

0x8dea897d8a25b32a354d41c1c6d96aa6c19466a8a743fc41c3c3da97d7cd9fb131f0e905b96c4bfb560a74fb52ae454ca1a73b7189710fc6a35236d0bc11d1d51c

Here's what i have tried so far:

1. Tried to convert the typed data to a signable message using eip-712 npm package and then trying to sign it with KMS. However , the signature did not get verified.

2. ethers-aws-kms-signer

   Tried to send a transaction using the above package , even sendTransaction is throwing error

"KeyId missing in the params"

3. Tried to implement the concept used in celo-monorepo. That did not work out for me. Reference
4. Then it was bunch of hit and trials.

Can anyone give me an idea on how to achieve this ? I cannot change the JSON schema for the typed data since the contract is already deployed.

Appreciate your time. Please comment.

Thanks!

Answer 1

You can use this repo and it's PRs https://github.com/rjchow/ethers-aws-kms-signer

Answer 2

This repository could provide a good solution : https://github.com/JonathanOkz/web3-kms-signer

import { Signer } from "@web3-kms-signer/core";
import { KMSWallets } from "@web3-kms-signer/kms-wallets";
import { KMSProviderAWS } from "@web3-kms-signer/kms-provider-aws";

const awsConfig = {
    region: 'us-east-1',
    credentials: {
        accessKeyId: 'YOUR_AWS_ACCESS_KEY_ID',
        secretAccessKey: 'YOUR_AWS_SECRET_ACCESS_KEY'
    }
};
const provider = new KMSProviderAWS(awsConfig);

const chainId = 3; // Ropsten
const signer = new Signer(new KMSWallets(provider), chainId);

const txData = {
    nonce: '0x00', // Replace with actual nonce
    gasPrice: '0x09184e72a000', // Replace with actual gas price
    gasLimit: '0x2710', // Replace with actual gas limit
    to: '0x0000000000000000000000000000000000000000', // Replace with recipient address
    value: '0x00', // Amount to send
    data: '0x0', // Data payload if any
};

const signedTx = await signer.signTransaction({ keyId: 'keyId' }, txData);

If you wish to gain a deeper insight into the underlying processes, I recommend consulting the this article : https://jonathanokz.medium.com/secure-an-ethereum-wallet-with-a-kms-provider-2914bd1e4341