aws-kms-secp256k1

Sign with secp256k1 keys that never leave AWS KMS: one fail-closed core, with signers for Casper and for ethers v6.

Package	For
@make-software/aws-kms-secp256k1	the shared core: key pinning, digest signing, strict DER, low s, verification, recovery id
@make-software/casper-aws-kms	casper-js-sdk 5.x transactions (TransactionV1 and legacy Deploy)
@make-software/ethers-aws-kms	an ethers v6 Signer: every transaction type, EIP-191, EIP-712, EIP-7702

The same KMS key can sign for Casper and for an EVM chain; both signers apply the same checks through the core.

npm install @make-software/ethers-aws-kms ethers @aws-sdk/client-kms          # EVM
npm install @make-software/casper-aws-kms casper-js-sdk @aws-sdk/client-kms   # Casper

Each package README has usage, the KMS key requirements and the full list of guarantees. In short, every signer:

• signs in KMS DIGEST mode, so nothing is hashed twice
• pins the key ARN an alias resolves to, refuses any other key type, and can pin the expected public key or address
• normalizes to low s and verifies every signature against the pinned key before returning it
• passes every KMS error through unchanged and never falls back to another key

The packages are pre-1.0: the API may still change between minor versions. Node.js 22 or later.

Security

Please report vulnerabilities privately; see SECURITY.md.

Development

npm ci
npm test            # all packages (no AWS)
npm run typecheck
npm run build
npm run smoke:pack  # pack the packages; install them with every supported casper-js-sdk and ethers release; run known answers and the README flows under native Node ESM
python3 scripts/mutation-check.py   # remove each guard in turn; the suite must fail every time

Live checks against real KMS and real networks are in each package's scripts/ directory. They need AWS credentials and a funded key.

License

Apache-2.0. See LICENSE and NOTICE.