Signing Transactions Externally with AWS KMS (ECDSA)

[mickeymond]

        // Create the transfer transaction
        TransferTransaction transaction = new TransferTransaction()
                .addTokenTransfer(TokenId.fromString("0.0.4537503"), AccountId.fromString("0.0.5739407"), -5555)
                .addTokenTransfer(TokenId.fromString("0.0.4537503"), AccountId.fromString("0.0.4537502"), 5555)
                .freezeWith(client);

        SignRequest signRequest = SignRequest.builder()
                .keyId(dotenv.get("AWS_KMS_KEY_ID"))
                .messageType(MessageType.RAW)
                .message(SdkBytes.fromByteArray(transaction.toBytes()))
                .signingAlgorithm(SigningAlgorithmSpec.ECDSA_SHA_256)
                .build();

        SignResponse signResponse = kmsClient.sign(signRequest);
        
        Transaction signedTransaction = Transaction.fromBytes(signResponse.signature().asByteArray());

The code above is failing with the error below for the statement,
Transaction signedTransaction = Transaction.fromBytes(signResponse.signature().asByteArray());

Exception in thread "main" com.google.protobuf.InvalidProtocolBufferException: Protocol message contained an invalid tag (zero).
	at com.google.protobuf.InvalidProtocolBufferException.invalidTag(InvalidProtocolBufferException.java:133)
	at com.google.protobuf.ArrayDecoders.decodeUnknownField(ArrayDecoders.java:1022)
	at com.google.protobuf.MessageSchema.parseProto3Message(MessageSchema.java:5465)
	at com.google.protobuf.MessageSchema.mergeFrom(MessageSchema.java:5481)
	at com.google.protobuf.GeneratedMessageLite.parsePartialFrom(GeneratedMessageLite.java:1678)
	at com.google.protobuf.GeneratedMessageLite.parseFrom(GeneratedMessageLite.java:1767)
	at com.hedera.hashgraph.sdk.proto.TransactionList.parseFrom(TransactionList.java:148)
	at com.hedera.hashgraph.sdk.Transaction.fromBytes(Transaction.java:243)
	at org.example.PayFeesForAccountTutorial.main(PayFeesForAccountTutorial.java:49)

Java JDK Version = 19

[nathanklick]

@mickeymond It looks likes the Amazon SDK is attaching a signature to the protobuf payload which is not supported.

Does the AWS KMS SDK support generating a detached signature?

[mickeymond]

@nathanklick If my knowledge of a detached signature is correct, then that is how AWS is handling it.
In that, you have to pass both the original data plus the signature for it to be verified against it.

[mickeymond]

@nathanklick After spending some time with it, I am convinced that the Signature returned from KSM SIGN needs to be manipulated in a certain way to get something that will pass verification when submitted to the Hedera network.
What can I do to get the needed help from the community to resolve this one?

[mickeymond]

@nathanklick Thank you very much.
I have been able to get this one to work.

[mickeymond]

package org.example;

import io.github.cdimascio.dotenv.Dotenv;
import org.bouncycastle.asn1.ASN1Integer;
import org.bouncycastle.asn1.ASN1Sequence;
import org.web3j.crypto.ECDSASignature;
import org.web3j.crypto.Hash;
import org.web3j.utils.Numeric;
import software.amazon.awssdk.auth.credentials.ProfileCredentialsProvider;
import software.amazon.awssdk.core.SdkBytes;
import software.amazon.awssdk.services.kms.KmsClient;
import software.amazon.awssdk.services.kms.model.SignRequest;
import software.amazon.awssdk.services.kms.model.SigningAlgorithmSpec;

import java.util.function.UnaryOperator;

public class TransactionSigner {
    public static UnaryOperator<byte[]> transactionSigner = bytesToSign -> {
        System.out.println("Signing transaction in transactionSigner");

        // Create keccak256 message digest
        String dataHex = Numeric.toHexString(bytesToSign);
        byte[] hash = Hash.sha256(("0x" + dataHex).getBytes());

        // AWS KMS Client setup
        KmsClient kmsClient = KmsClient.builder()
                .credentialsProvider(ProfileCredentialsProvider.create("kms-user"))
                .build();

        // Send digest to KMS for signing
        SignRequest signRequest = SignRequest.builder()
                .keyId(Dotenv.load().get("AWS_KMS_KEY_ID"))
                .message(SdkBytes.fromByteArray(hash))
                .signingAlgorithm(SigningAlgorithmSpec.ECDSA_SHA_256)
                .messageType("DIGEST")
                .build();

        byte[] signature = kmsClient.sign(signRequest).signature().asByteArray();

        // Construct ECDSA signature
        ASN1Sequence instance = ASN1Sequence.getInstance(signature);
        ASN1Integer rObject = (ASN1Integer) instance.getObjectAt(0);
        ASN1Integer sObject = (ASN1Integer) instance.getObjectAt(1);
        ECDSASignature ecdsaSignature = new ECDSASignature(rObject.getValue(), sObject.getValue()).toCanonicalised();

        byte[] r = ecdsaSignature.r.toByteArray();
        byte[] s = ecdsaSignature.s.toByteArray();

        byte[] result = new byte[64];
        System.arraycopy(r, 0, result, 0, 32);
        System.arraycopy(s, 32, result, 32, 32);

        return result;
    };
}

Give me an error

Exception in thread "main" com.hedera.hashgraph.sdk.ReceiptStatusException: receipt for transaction [email protected] raised status INVALID_SIGNATURE
	at com.hedera.hashgraph.sdk.TransactionReceipt.validateStatus(TransactionReceipt.java:297)
	at com.hedera.hashgraph.sdk.TransactionResponse.getReceipt(TransactionResponse.java:133)
	at com.hedera.hashgraph.sdk.TransactionResponse.getReceipt(TransactionResponse.java:117)
	at org.example.AssociateAccountWithToken.main(AssociateAccountWithToken.java:46)