[ANN] Tendermint KMS v0.0.1 Preview Release with initial YubiHSM2 support

NOTE: This release does not yet support validator signing! For progress on that, please watch PR#55 on the KMS repo, which is the last hurdle for unlocking this capability. Tendermint Key Management System (KMS) , a.k.a. `tmkms`, is an interface to Hardware Security Modules (HSMs), namely YubiHSM2 devices from Yubico, and soon, the Ledger Nano S . It’s intended to be run alongside Cosmos Validators, ideally on separate physical hosts, providing defense-in-depth for online validator signing keys as well as a central signing service that can be used when operating multiple validators in several Cosmos Zones. We’ve just released `tmkms` v0.0.1 which contains an initial preview of the KMS’s functionality. Specifically, this release is capable of generating and listing keys within YubiHSM2s as well as a signing stress test to ensure the software is stable and robust. As noted at the top of this post, it cannot yet be used for validator signing, but we are very close to landing that functionality (hopefully in the next few days). The current release is a bit rough around the edges and doesn’t yet have full functionality, but we’re releasing early so you can start playing around…

Excerpt (1197 of 6906 characters). Read the whole post on the forum ↗

Very cool. All working well on Ubuntu 18.04lts. Only complication was a little bit of USB permission twiddling required. The stress test works fine, including pulling and replacing the YubiHSM2.

Success signed message using key ID #1 in 142 ms
Success signed message using key ID #1 in 142 ms
Success signed message using key ID #1 in 142 ms
error: signature operation failed: protocol error: I/O error: Input/Output Error
error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected
error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected
error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected
error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected
error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected
Success signed message using key ID #1 in 714 ms
Success signed message using key ID #1 in 142 ms
Success signed message using key ID #1 in 142 ms

serial: #000755_80_72 ?

Is there any information about configuring gaiad & the KMS 0.1.0 to work together?

Hi @mattharrop,

I’m planning on doing another release (v0.2) either later today or tomorrow with updates to the configuration file syntax, and have been holding off on making a bigger announcement until that happens.

Stay tuned though!