Seedphrase encryption tool via KMS - #13
Merged
Merged
Conversation
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
RodriFS
approved these changes
Aug 19, 2026
stack merge was automatically disabled
August 19, 2026 13:34
Pull Request is not mergeable
stack merge was automatically disabled
August 19, 2026 13:34
Pull Request is not mergeable
New console project RemoteSigner.SeedCeremony (assembly 'seed-ceremony') replacing the old provisioning flow of pasting the mnemonic into the GenerateEncryptedSeedTest unit test. It references the RemoteSigner project and reuses its SignPSBTConfig/EncryptSeedphrase/DecryptSeedphrase/ ParseNetwork, so the emitted MF_* env var is compatible by construction. Commands: - generate: fresh 24-word mnemonic (interactive TTY enforced, shown once, backup quiz, screen+scrollback wipe), KMS-encrypt, emit manifest - encrypt: same for an existing mnemonic (--seed-file or hidden prompt, never argv) - verify: preflight gate - KMS-decrypts the manifest env value through the lambda's own decrypt path and re-derives fingerprint/env name/xpub The manifest holds public data only (env name/value, master fingerprint, account xpub, derivation path, network). AWS credentials come from the default chain, optionally --profile/--region. Function.cs: additive refactors only - EncryptSeedphrase overload with an injected IAmazonKeyManagementService and public static DecryptSeedphrase extracted from DecryptSeed (existing signatures delegate). Also: 10 new tests (derivation matches NodeGuard's InternalWallet.GetXPUB, env value round-trips the lambda's deserialization, fake-KMS encrypt/ decrypt round trip, verify failure modes), just ceremony-* recipes, README ceremony + snapshot->merge->apply env procedure, and removal of the stale AWS_KMS_KEY_ID NodeGuard env var mention (NodeGuard never reads it).
- just ceremony-test-local [endpoint]: runs encrypt -> verify against a local AWS emulator's KMS (floci/LocalStack, default localhost:4566) using the committed public dev vector, asserting fingerprint ed0210c8 round-trips. Never touches real AWS; emulator ciphertexts are throwaway. - Serialize the manifest and env value with UnsafeRelaxedJsonEscaping so operators see plain quotes and base64 plus signs instead of u0022/u002B unicode escapes. Presentation only: JSON parsers decode both encodings identically.
Jossec101
force-pushed
the
feat/seed-ceremony
branch
from
August 19, 2026 13:36
394cac6 to
9536f33
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR introduces a new binary to simplify key rotations via creating/using a new BIP39 seedphrase and encrypting it generating a manifest that can be used safely to modify nodeguard db and lambda functions for remote signer
Stack created with GitHub Stacks CLI • Give Feedback 💬