EVM Node: Add SECP256K1 support for GCP KMS signing
Part of L2-191
What
This patch introduces support for SECP256K1 signature algorithm within the GCP KMS integration. This enables the use of keys stored in Google Cloud Key Management Service that are configured with the SECP256K1 curve for cryptographic operations, specifically for signing.
Why
The primary motivation for this change is to allow the Etherlink node to sign transactions using SECP256K1 keys managed by GCP KMS.
How
The implementation involves extending the signature_algorithm type to include
EC_SIGN_SECP256K1_SHA256 and updating the parsing logic. A pem_to_der
helper function was added to correctly decode PEM-encoded public keys, and a
tag function was introduced to provide the correct prefix byte for both P256
and SECP256K1 public keys when converting them to Tezos Signature.Public_key
format. The key_of_pem function was refactored to use this new common DER
decoding and tagging logic.
Manually testing the MR
Checklist
-
Document the interface of any function added or modified (see the coding guidelines) -
Document any change to the user interface, including configuration parameters (see node configuration) -
Provide automatic testing (see the testing guide). -
For new features and bug fixes, add an item in the appropriate changelog ( docs/protocols/alpha.rstfor the protocol and the environment,CHANGES.rstat the root of the repository for everything else). -
Select suitable reviewers using the Reviewersfield below. -
Select as Assigneethe next person who should take action on that MR