Looking for a Dev Fund Champion: self-hosted KMS drivers for validators (OpenBao/Vault, Scaleway, PKCS#11)
- ian.lawrenceOP
The validator security guide says to keep participant keys in a KMS or HSM. Today the only supported options are AWS KMS and Google Cloud KMS (and I think Azure), so operators who self-host, run on another cloud, or have to use their own HSM have no maintained way to follow that advice.
Saxon has released two Apache-2.0 Canton KMS drivers:
- OpenBao / HashiCorp Vault Transit: GitHub - saxon-xyz/canton-kms-driver-openbao: Canton KMS driver for the OpenBao / HashiCorp Vault Transit engine: keep Canton participant keys in a self-hosted key service, on any provider · GitHub
- Scaleway Key Manager: GitHub - saxon-xyz/canton-kms-driver-scaleway: Canton KMS driver for Scaleway Key Manager: keep Canton participant keys in Scaleway's managed KMS · GitHub
Both pass Digital Asset’s KMS driver test suite and have run a DevNet validator end to end. They also load unchanged in the Splice 0.10.0 participant image.
Dev Fund proposal PR #950 ( Proposal: Self-Hosted KMS Drivers for Canton Validators (RFP 26) by IanLawrence · Pull Request #950 · canton-foundation/canton-dev-fund · GitHub ) asks for a year of maintenance for both drivers across Canton and Splice releases, a PKCS#11 driver for hardware HSMs (tested on a YubiHSM 2), and the testing and documentation other operators need to adopt them. The proposal’s success measure is independent operators running the drivers. It responds to RFP 26 (Key Management and Signing Controls) and RFP 7.
The proposal still needs a Tech & Ops Champion. If you run validators and this would be useful to you, or if you can champion the proposal, please reply here or comment on the PR. We’d also like to hear from anyone who needs a particular HSM or KMS supported.
Cheers!