Hyper Protect Services for Edwards Curve Signing Server

Cybersecurity attacks have become very common where hospital systems, critical infrastructure companies, and financial services organizations have been under constant threat of being held hostage. File-Based Digital Assets (FBDA), which include PDFs, Digital Wallets, and so on, hold tremendous value and need to be protected against such attacks.

One way to protect FBDA's is by using encryption keys obtained from a Hardware Security Module to "digitally sign" the asset.

This tutorial shows you how to build and run an example signing server application to sign FBDA's using an Edwards Curve Digital Signature Algorithm (EdDSA) to sign and verify signatures. The example signing server will take advantage of the quantum safe capabilities of the FIPS 140-2 Level 4 HSM on IBM LinuxONE to protect against "harvest-now-payoff-later" attacks.

The Sample Signing Server

The signing server we describe here is built on the IBM Hyper Protect Services platform, which leverages Secure Execution for Linux on a LinuxONE to provide "Technical Assurance". This makes it possible for the signing server to be deployed in either IBM Cloud or in a LinuxONE on-premises environment, with the assurance that only the customer has access to the server-environment on which the signing operations will be done.

For ease of implementation, we will leverage the quantum safe HSM capabilities provided by IBM Cloud Hyper Protect Crypto Services. The signing server itself can be deployed on a regular VM or you can opt to run it in a secure enclave provided by Hyper Protect Virtual Servers.

The signing server uses the Enterprise PKCS #11 to create keys, sign data, and verify signatures with an HSM provided by Hyper Protect Crypto Services.

The Sample Signing Server provides REST APIs to create and use Dilithium signing keys for quantum-safe signing.

The signing server is implemented in Java on basis of Open Liberty. It uses the Enterprise PKCS#11 over gRPC (GREP11) API to create keys, sign data and verify signatures in a IBM Cloud Hyper Protect Crypto Services instance.

Steps

Step 1. Download and build the signing server

Log on to your Linux VM. If you don't have one, you can provision a Virtual Server Instance (VSI) on IBM Cloud VPC. To run the signing server in a "secure-enclave", you will need to create a contract to make sure the secure enclave runs "only" the workload to intend to run and nothing else. For simplicity sake, we will not be going into the details of creating the secure enclave.

Clone the Signing Server application:

git clone https://github.com/IBM/signingserver

Build the signing server application:

export PATH="/path/bin:$PATH"
mvn clean install

Build the Container image:

docker build . -t signingserver

Step 2. Gather HPCS connection information

1. Navigate to IBM Cloud Service-IDs to create a Service-ID that has "Key Operator, Crypto Operator" access to your HPCS instance.

2. Click the API Key tab on the ServiceID you just created.

   

3. Create an API Key and download it. You will use it for the API_KEY value in the next step.

   

4. Navigate to your IBM Cloud Resources page and collect the following information from the HPCS-Overview tab:

   • HPCS_INSTANCEID
   • HPCS_ENDPOINT

   • HPCS_PORT

     

Step 3. Run the Container image

Use the information collected in the previous step to run the Signing Server container as follows:

docker run -it -p 9443:9443 -e API_KEY=<your api key> -e HPCS_PORT=<port> -e HPCS_INSTANCEID=<instance id> -e HPCS_ENDPOINT=<EP11 endpoint, e.g. ep11.us-east.hs-crypto.cloud.ibm.com> signingserver

Make a note of the Server-IP-address.

Step 4. Use the Signing Server application

Note: All commands and actions in this section can be executed from any environment as long as network connectivity to "Server-IP-address" is possible.

1. Create a Dilithium Key Pair.

    curl -k --request POST \
      --url https://<server-ip-address>:9443/signing/api/v2/keys \
      --header 'Content-Type: application/json' \
      --data '{}'
   

2. Create an elliptic curve key pair.

    curl -k --request POST \
      --url https://<server-ip-address>:9443/signing/api/v2/keys?type=EC \
      --header 'Content-Type: application/json' \
      --data '{}'
   

3. Sign a PDF document. First, encode the PDF document that needs to be signed with Base64 encoding format:

    base64 <input-pdf-file> > <output-pdf-base64-file>
   

   Then, sign the document:

    curl -k --request POST \
      --url https://<server-ip-address>:9443/signing/api/v2/sign \
      --header 'Content-Type: application/json' \
      --data-binary "path-to-base64-pdf-file" \
      --data '{
        "id": "<key-id-to-use>"
    }'
   

For more information on API requests to the signing server, check out its GitHub repo.

Summary

The IBM Hyper Protect Services team created the "Sample Server" to demonstrate certain capabilities of the FIPS 140-2 Level 4 HSM on IBM LinuxONE. It is by no means an exhaustive enumeration of all the capabilities that currently exist at the time of publishing this tutorial and all the future developmental efforts in this area of technology.

Give the signing server a try, reach out to us or your IBM representative with any requests for enhancements.