An Ethers.js compatible signer that connects to GCP KMS. 

An Ethers.js compatible signer that connects to GCP KMS

openlawbot

ethers-gcp-kms-signer

## [1.1.6](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.5...v1.1.6) (2022-11-17)

* parse line break for gcp env var ([721accf](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/721accf412fdcb271f1e4e559820a6e0071e52d6))

## [1.1.5](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.4...v1.1.5) (2022-11-15)

* read gcreds from env var ([7fcc05d](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/7fcc05d79e4d06bda0920dcc785e0560cd7d2835))

## [1.1.4](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.3...v1.1.4) (2022-10-31)

* gh release workflow ([14acd9a](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/14acd9a3ebd47e29f3d4d0e6062902f88c984ed2))

## [1.1.3](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.2...v1.1.3) (2022-10-31)

* bump google kms lib version ([84ea5db](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/84ea5dbcf1751cd59d4095ae836257379dd52352))

* lock ethers lib version ([31c499b](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/31c499b9f317fbd6be055f540a08e2d25cb50abe))

* lock lib version ([26fe9e5](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/26fe9e5b61a516a389b7e72639b7e34524561755))

* deployment action ([492b400](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/492b40084844ab82aadde3784a96ee29af8ad995))

* github workflows dir ([8371d5a](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/8371d5a1eb8cc1ee0927f7fab2bf6bf79bed7820))

## [1.1.2](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.1...v1.1.2) (2022-01-14)

* build issue [#3](https://github.com/openlawteam/ethers-gcp-kms-signer/issues/3) ([#4](https://github.com/openlawteam/ethers-gcp-kms-signer/issues/4)) ([4b7fb51](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/4b7fb51dcf0d68a52cb525bc2b3a96bcab95ca2c))

## [1.1.1](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.0...v1.1.1) (2021-10-28)

* recoverPubKey function ([20af9ba](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/20af9ba81d25c1f61bd902d3e23e5f416ae345e9))

# [1.1.0](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.0.0...v1.1.0) (2021-10-28)

* sign typed data with gcp kms ([#2](https://github.com/openlawteam/ethers-gcp-kms-signer/issues/2)) ([a77b11f](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/a77b11f85621d12b087977c27302dadf27ed9b39))

* enabled circle ci ([23171d4](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/23171d4b857370933df429c5018d3d8fe5b7b2c2))

* ignore integration test ([1e5628f](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/1e5628f74efb91773fb9eed5f621ee804b72bcc2))

* set correct folder name ([c5fa66a](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/c5fa66ab7716715e76e7a4c7abf683c74f787501))

* set the correct branch name ([bf5ce76](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/bf5ce76c7638aa318ce2c7bf4dc784dc9ace8df3))

* gcp kms signer ([e290230](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/e290230386a28a4b6b7fa4b4ecb13e365f1b8ed0))

Object.defineProperty(exports, "__esModule", {

exports.determineCorrectV = determineCorrectV;

exports.findEthereumSig = findEthereumSig;

exports.getEthereumAddress = getEthereumAddress;

exports.requestKmsSignature = requestKmsSignature;

var asn1 = _interopRequireWildcard(require("asn1.js"));

var _bn = _interopRequireDefault(require("bn.js"));

var _keyEncoder = _interopRequireDefault(require("key-encoder"));

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }

function _slicedToArray(arr, i) { return _arrayWithHoles(arr) || _iterableToArrayLimit(arr, i) || _unsupportedIterableToArray(arr, i) || _nonIterableRest(); }

function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }

function _unsupportedIterableToArray(o, minLen) { if (!o) return; if (typeof o === "string") return _arrayLikeToArray(o, minLen); var n = Object.prototype.toString.call(o).slice(8, -1); if (n === "Object" && o.constructor) n = o.constructor.name; if (n === "Map" || n === "Set") return Array.from(o); if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _arrayLikeToArray(o, minLen); }

function _arrayLikeToArray(arr, len) { if (len == null || len > arr.length) len = arr.length; for (var i = 0, arr2 = new Array(len); i < len; i++) arr2[i] = arr[i]; return arr2; }

function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }

const keyEncoder = new _keyEncoder.default("secp256k1");

/* this asn1.js library has some funky things going on */

const EcdsaSigAsnParse = asn1.define("EcdsaSig", function () {

  // parsing this according to https://tools.ietf.org/html/rfc3279#section-2.2.3

  this.seq().obj(this.key("r").int(), this.key("s").int());

const EcdsaPubKey = asn1.define("EcdsaPubKey", function () {

  // parsing this according to https://tools.ietf.org/html/rfc5480#section-2

  this.seq().obj(this.key("algo").seq().obj(this.key("a").objid(), this.key("b").objid()), this.key("pubKey").bitstr());

  return process.env.GOOGLE_APPLICATION_CREDENTIAL_EMAIL && process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY ? {

      client_email: process.env.GOOGLE_APPLICATION_CREDENTIAL_EMAIL,

      private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY

      private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY.replace(/\\n/gm, "\n")

  _sign = _asyncToGenerator(function* (digest, kmsCredentials) {

    const kms = new _kms.KeyManagementServiceClient(getClientCredentials());

    const versionName = kms.cryptoKeyVersionPath(kmsCredentials.projectId, kmsCredentials.locationId, kmsCredentials.keyRingId, kmsCredentials.keyId, kmsCredentials.keyVersion);

    const _yield$kms$asymmetric = yield kms.asymmetricSign({

      _yield$kms$asymmetric2 = _slicedToArray(_yield$kms$asymmetric, 1),

      asymmetricSignResponse = _yield$kms$asymmetric2[0];

const getPublicKey = /*#__PURE__*/function () {

  var _ref = _asyncToGenerator(function* (kmsCredentials) {

    const _yield$kms$getPublicK = yield kms.getPublicKey({

      _yield$kms$getPublicK2 = _slicedToArray(_yield$kms$getPublicK, 1),

      publicKey = _yield$kms$getPublicK2[0];

    if (!publicKey || !publicKey.pem) throw new Error(`Can not find key: ${kmsCredentials.keyId}`);

    // GCP KMS returns the public key in pem format,

    // so we need to encode it to der format, and return the hex buffer.

    const der = keyEncoder.encodePublic(publicKey.pem, "pem", "der");

  // The public key here is a hex der ASN1 encoded in a format according to

  // https://tools.ietf.org/html/rfc5480#section-2

  // I used https://lapo.it/asn1js to figure out how to parse this

  // and defined the schema in the EcdsaPubKey object.

  const res = EcdsaPubKey.decode(publicKey, "der");

  // The raw format public key starts with a `04` prefix that needs to be removed

  // more info: https://www.oreilly.com/library/view/mastering-ethereum/9781491971932/ch04.html

  // const pubStr = publicKey.toString();

  const pubFormatted = pubKeyBuffer.slice(1, pubKeyBuffer.length);

  const address = _ethers.ethers.utils.keccak256(pubFormatted);

  // take last 20 bytes as ethereum address

  const EthAddr = `0x${address.slice(-40)}`;

  const decoded = EcdsaSigAsnParse.decode(signature, "der");

  const secp256k1N = new _bn.default("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141", 16); // max value on the curve

  const secp256k1halfN = secp256k1N.div(new _bn.default(2)); // half of the curve

  // Because of EIP-2 not all elliptic curve signatures are accepted

  // the value of s needs to be SMALLER than half of the curve

  // i.e. we need to flip s if it's greater than half of the curve

  // if s is less than half of the curve, we're on the "good" side of the curve, we can just return

    s: s.gt(secp256k1halfN) ? secp256k1N.sub(s) : s

  return _requestKmsSignature.apply(this, arguments);

  _requestKmsSignature = _asyncToGenerator(function* (plaintext, kmsCredentials) {

    const response = yield sign(plaintext, kmsCredentials);

    if (!response || !response.signature) {

      throw new Error(`GCP KMS call failed`);

    return findEthereumSig(response.signature);

function recoverPubKeyFromSig(msg, r, s, v) {

  return _ethers.ethers.utils.recoverAddress(`0x${msg.toString("hex")}`, {

function determineCorrectV(msg, r, s, expectedEthAddr) {

  // This is the wrapper function to find the right v value

  // There are two matching signatures on the elliptic curve

  // we need to find the one that matches to our public key

  "description": "An Ethers.js compatible signer that connects to GCP KMS",

    "coverage": "npm test -- --coverage",

    "build": "tsc -p tsconfig.build.json --emitDeclarationOnly && babel src -d dist --ignore **/*.test.d.ts,**/*.test.ts -x .ts",

    "preversion": "npm run lint && npm test && npm run build",

    "semantic-release": "semantic-release",

    "commitlint-circle": "commitlint-circle",

    "url": "git+https://github.com/openlawteam/ethers-gcp-kms-signer.git"

    "url": "https://github.com/openlawteam/ethers-gcp-kms-signer/issues"

  "homepage": "https://github.com/openlawteam/ethers-gcp-kms-signer#readme",

    "@babel/plugin-proposal-class-properties": "^7.14.5",

    "@babel/plugin-proposal-nullish-coalescing-operator": "^7.14.5",

    "@babel/plugin-proposal-optional-chaining": "^7.14.5",

    "@babel/preset-typescript": "^7.15.0",

    "@commitlint/config-conventional": "^13.2.0",

    "@ls-age/commitlint-circle": "^1.0.0",

    "@types/google-cloud__kms": "^1.5.3",

    "@typescript-eslint/eslint-plugin": "^5.2.0",

    "@typescript-eslint/parser": "^5.2.0",

    "eslint-config-airbnb-base": "^14.2.1",

    "semantic-release-npm-github-publish": "^1.5.1",

import { KeyManagementServiceClient } from "@google-cloud/kms";

import { GcpKmsSignerCredentials } from "../signer";

const keyEncoder = new KeyEncoder("secp256k1");

  decode: (asnStringBuffer: Buffer, format: "der") => { r: BN; s: BN };

} = asn1.define("EcdsaSig", function (this: any) {

const EcdsaPubKey = asn1.define("EcdsaPubKey", function (this: any) {

  return process.env.GOOGLE_APPLICATION_CREDENTIAL_EMAIL && process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY

          client_email: process.env.GOOGLE_APPLICATION_CREDENTIAL_EMAIL,

          private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY,

          private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY.replace(/\\n/gm, "\n"),

export async function sign(digest: Buffer, kmsCredentials: GcpKmsSignerCredentials) {

  const kms = new KeyManagementServiceClient(getClientCredentials());

  const versionName = kms.cryptoKeyVersionPath(

  const [asymmetricSignResponse] = await kms.asymmetricSign({

export const getPublicKey = async (kmsCredentials: GcpKmsSignerCredentials) => {

  const [publicKey] = await kms.getPublicKey({

  if (!publicKey || !publicKey.pem) throw new Error(`Can not find key: ${kmsCredentials.keyId}`);

  // GCP KMS returns the public key in pem format,

  // so we need to encode it to der format, and return the hex buffer.

  const der = keyEncoder.encodePublic(publicKey.pem, "pem", "der");

export function getEthereumAddress(publicKey: Buffer): string {

  const pubKeyBuffer: Buffer = res.pubKey.data;

  const address = ethers.utils.keccak256(pubFormatted);

export function findEthereumSig(signature: Buffer) {

  const secp256k1N = new BN("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141", 16); // max value on the curve

  const secp256k1halfN = secp256k1N.div(new BN(2)); // half of the curve

  return { r, s: s.gt(secp256k1halfN) ? secp256k1N.sub(s) : s };

export async function requestKmsSignature(plaintext: Buffer, kmsCredentials: GcpKmsSignerCredentials) {

  const response = await sign(plaintext, kmsCredentials);

  if (!response || !response.signature) {

    throw new Error(`GCP KMS call failed`);

  return findEthereumSig(response.signature as Buffer);

function recoverPubKeyFromSig(msg: Buffer, r: BN, s: BN, v: number) {

  return ethers.utils.recoverAddress(`0x${msg.toString("hex")}`, {

export function determineCorrectV(msg: Buffer, r: BN, s: BN, expectedEthAddr: string) {

  let pubKey = recoverPubKeyFromSig(msg, r, s, v);

  if (pubKey.toLowerCase() !== expectedEthAddr.toLowerCase()) {

    // if the pub key for v = 27 does not match

		{
		"name": "ethers-gcp-kms-signer",
		"version": "1.1.5",
		"version": "1.1.6",
		"description": "An Ethers.js compatible signer that connects to GCP KMS",
		@@ -5,0 +5,0 @@ "main": "dist/signer.js",

		@@ -0,1 +1,8 @@
		## [1.1.6](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.5...v1.1.6) (2022-11-17)


		### fix

		* parse line break for gcp env var ([721accf](https://github.com/openlawteam/ethers-gcp-kms-signer/commit/721accf412fdcb271f1e4e559820a6e0071e52d6))

		## [1.1.5](https://github.com/openlawteam/ethers-gcp-kms-signer/compare/v1.1.4...v1.1.5) (2022-11-15)
		@@ -2,0 +9,0 @@

		@@ -46,3 +46,3 @@ "use strict";
		client_email: process.env.GOOGLE_APPLICATION_CREDENTIAL_EMAIL,
		private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY
		private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY.replace(/\\n/gm, "\n")
		}
		@@ -49,0 +49,0 @@ } : {};

		@@ -29,3 +29,3 @@ import { ethers } from "ethers";
		client_email: process.env.GOOGLE_APPLICATION_CREDENTIAL_EMAIL,
		private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY,
		private_key: process.env.GOOGLE_APPLICATION_CREDENTIAL_PRIVATE_KEY.replace(/\\n/gm, "\n"),
		},
		@@ -32,0 +32,0 @@ }

Improved metrics