@constellation-labs/key-manager
Version:
[Constellation] Keys and secrets management
103 lines • 4.33 kB
JavaScript
;
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.determineCorrectV = exports.requestKmsSignature = exports.findEthereumSig = exports.getEthereumAddress = exports.getPublicKey = exports.sign = void 0;
const ethers_1 = require("ethers");
const aws_sdk_1 = require("aws-sdk");
const asn1 = __importStar(require("asn1.js"));
const bn_js_1 = __importDefault(require("bn.js"));
const EcdsaSigAsnParse = asn1.define('EcdsaSig', function () {
this.seq().obj(this.key('r').int(), this.key('s').int());
});
const EcdsaPubKey = asn1.define('EcdsaPubKey', function () {
this.seq().obj(this.key('algo').seq().obj(this.key('a').objid(), this.key('b').objid()), this.key('pubKey').bitstr());
});
const sign = async (digest, kmsCredentials) => {
const kms = new aws_sdk_1.KMS(kmsCredentials);
const params = {
KeyId: kmsCredentials.keyId,
Message: digest,
SigningAlgorithm: 'ECDSA_SHA_256',
MessageType: 'DIGEST',
};
const res = await kms.sign(params).promise();
return res;
};
exports.sign = sign;
const getPublicKey = async (kmsCredentials) => {
const kms = new aws_sdk_1.KMS(kmsCredentials);
return kms
.getPublicKey({
KeyId: kmsCredentials.keyId,
})
.promise();
};
exports.getPublicKey = getPublicKey;
const getEthereumAddress = (publicKey) => {
const res = EcdsaPubKey.decode(publicKey, 'der');
let pubKeyBuffer = res.pubKey.data;
pubKeyBuffer = pubKeyBuffer.slice(1, pubKeyBuffer.length);
const address = ethers_1.ethers.utils.keccak256(pubKeyBuffer);
const EthAddr = `0x${address.slice(-40)}`;
return EthAddr;
};
exports.getEthereumAddress = getEthereumAddress;
const findEthereumSig = (signature) => {
const decoded = EcdsaSigAsnParse.decode(signature, 'der');
const { r, s } = decoded;
const secp256k1N = new bn_js_1.default('fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141', 16);
const secp256k1halfN = secp256k1N.div(new bn_js_1.default(2));
return { r, s: s.gt(secp256k1halfN) ? secp256k1N.sub(s) : s };
};
exports.findEthereumSig = findEthereumSig;
const requestKmsSignature = async (plaintext, kmsCredentials) => {
const signature = await (0, exports.sign)(plaintext, kmsCredentials);
if (signature.$response.error || signature.Signature === undefined) {
throw new Error(`AWS KMS call failed with: ${signature.$response.error}`);
}
return (0, exports.findEthereumSig)(signature.Signature);
};
exports.requestKmsSignature = requestKmsSignature;
const recoverPubKeyFromSig = (msg, r, s, v) => {
return ethers_1.ethers.utils.recoverAddress(`0x${msg.toString('hex')}`, {
r: `0x${r.toString('hex')}`,
s: `0x${s.toString('hex')}`,
v,
});
};
const determineCorrectV = (msg, r, s, expectedEthAddr) => {
let v = 27;
let pubKey = recoverPubKeyFromSig(msg, r, s, v);
if (pubKey.toLowerCase() !== expectedEthAddr.toLowerCase()) {
v = 28;
pubKey = recoverPubKeyFromSig(msg, r, s, v);
}
return { pubKey, v };
};
exports.determineCorrectV = determineCorrectV;
//# sourceMappingURL=aws-kms-utils.js.map