Security Module Plugin API

acceptance-tests/dsl/build.gradle

@@ -16,6 +16,7 @@ dependencies {
   implementation project(':metrics:core')
   implementation project(':plugin-api')
   implementation project(':plugins:rocksdb')
+  implementation project(':plugins:securitymodule-bouncycastle')
   implementation project(':services:kvstore')
   implementation project(':testutil')
   implementation project(':util')

acceptance-tests/dsl/src/main/java/org/hyperledger/besu/tests/acceptance/dsl/node/ThreadBesuNodeRunner.java

@@ -23,7 +23,7 @@
 import org.hyperledger.besu.controller.BesuController;
 import org.hyperledger.besu.controller.BesuControllerBuilder;
 import org.hyperledger.besu.controller.GasLimitCalculator;
-import org.hyperledger.besu.crypto.KeyPairUtil;
+import org.hyperledger.besu.crypto.NodeKey;
 import org.hyperledger.besu.ethereum.api.graphql.GraphQLConfiguration;
 import org.hyperledger.besu.ethereum.eth.EthProtocolConfiguration;
 import org.hyperledger.besu.ethereum.eth.sync.SynchronizerConfiguration;
@@ -37,12 +37,16 @@
 import org.hyperledger.besu.plugin.services.BesuConfiguration;
 import org.hyperledger.besu.plugin.services.BesuEvents;
 import org.hyperledger.besu.plugin.services.PicoCLIOptions;
+import org.hyperledger.besu.plugin.services.SecurityModuleService;
 import org.hyperledger.besu.plugin.services.StorageService;
+import org.hyperledger.besu.plugin.services.securitymodule.SecurityModule;
+import org.hyperledger.besu.plugin.services.securitymodule.bouncycastle.BouncyCastleSecurityModulePlugin;
 import org.hyperledger.besu.plugin.services.storage.rocksdb.RocksDBPlugin;
 import org.hyperledger.besu.services.BesuConfigurationImpl;
 import org.hyperledger.besu.services.BesuEventsImpl;
 import org.hyperledger.besu.services.BesuPluginContextImpl;
 import org.hyperledger.besu.services.PicoCLIOptionsImpl;
+import org.hyperledger.besu.services.SecurityModuleServiceImpl;
 import org.hyperledger.besu.services.StorageServiceImpl;
 
 import java.io.File;
@@ -71,10 +75,12 @@ public class ThreadBesuNodeRunner implements BesuNodeRunner {
   private BesuPluginContextImpl buildPluginContext(
       final BesuNode node,
       final StorageServiceImpl storageService,
+      final SecurityModuleServiceImpl securityModuleService,
       final BesuConfiguration commonPluginConfiguration) {
     final CommandLine commandLine = new CommandLine(CommandSpec.create());
     final BesuPluginContextImpl besuPluginContext = new BesuPluginContextImpl();
     besuPluginContext.addService(StorageService.class, storageService);
+    besuPluginContext.addService(SecurityModuleService.class, securityModuleService);
     besuPluginContext.addService(PicoCLIOptions.class, new PicoCLIOptionsImpl(commandLine));
 
     final Path pluginsPath = node.homeDirectory().resolve("plugins");
@@ -92,6 +98,7 @@ private BesuPluginContextImpl buildPluginContext(
 
     // register built-in plugins
     new RocksDBPlugin().register(besuPluginContext);
+    new BouncyCastleSecurityModulePlugin().register(besuPluginContext);
 
     return besuPluginContext;
   }
@@ -105,12 +112,16 @@ public void startNode(final BesuNode node) {
     ThreadContext.put("node", node.getName());
 
     final StorageServiceImpl storageService = new StorageServiceImpl();
+    final SecurityModuleServiceImpl securityModuleService = new SecurityModuleServiceImpl();
     final Path dataDir = node.homeDirectory();
     final BesuConfiguration commonPluginConfiguration =
         new BesuConfigurationImpl(dataDir, dataDir.resolve(DATABASE_PATH));
     final BesuPluginContextImpl besuPluginContext =
         besuPluginContextMap.computeIfAbsent(
-            node, n -> buildPluginContext(node, storageService, commonPluginConfiguration));
+            node,
+            n ->
+                buildPluginContext(
+                    node, storageService, securityModuleService, commonPluginConfiguration));
 
     final ObservableMetricsSystem metricsSystem =
         PrometheusMetricsSystem.init(node.getMetricsConfiguration());
@@ -133,13 +144,20 @@ public void startNode(final BesuNode node) {
             .withMetricsSystem(metricsSystem)
             .build();
 
+    final SecurityModule securityModule =
+        securityModuleService
+            .getByName("bouncycastle")
+            .orElseThrow(
+                () -> new IllegalStateException("BouncyCastle Security Module not available"))
+            .apply(commonPluginConfiguration);
+
     final BesuController<?> besuController =
         builder
             .synchronizerConfiguration(new SynchronizerConfiguration.Builder().build())
             .dataDirectory(node.homeDirectory())
             .miningParameters(node.getMiningParameters())
             .privacyParameters(node.getPrivacyParameters())
-            .nodePrivateKeyFile(KeyPairUtil.getDefaultKeyFile(node.homeDirectory()))
+            .nodeKey(new NodeKey(securityModule))
             .metricsSystem(metricsSystem)
             .transactionPoolConfiguration(TransactionPoolConfiguration.builder().build())
             .ethProtocolConfiguration(EthProtocolConfiguration.defaultConfig())

besu/build.gradle

@@ -48,6 +48,7 @@ dependencies {
   implementation project(':nat')
   implementation project(':plugin-api')
   implementation project(':plugins:rocksdb')
+  implementation project(':plugins:securitymodule-bouncycastle')
   implementation project(':services:kvstore')
 
   implementation 'com.fasterxml.jackson.core:jackson-databind'

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

@@ -51,7 +51,6 @@
 import org.hyperledger.besu.cli.presynctasks.PrivateDatabaseMigrationPreSyncTask;
 import org.hyperledger.besu.cli.subcommands.PasswordSubCommand;
 import org.hyperledger.besu.cli.subcommands.PublicKeySubCommand;
-import org.hyperledger.besu.cli.subcommands.PublicKeySubCommand.KeyLoader;
 import org.hyperledger.besu.cli.subcommands.RetestethSubCommand;
 import org.hyperledger.besu.cli.subcommands.blocks.BlocksSubCommand;
 import org.hyperledger.besu.cli.subcommands.blocks.BlocksSubCommand.JsonBlockImporterFactory;
@@ -66,7 +65,7 @@
 import org.hyperledger.besu.config.experimental.ExperimentalEIPs;
 import org.hyperledger.besu.controller.BesuController;
 import org.hyperledger.besu.controller.BesuControllerBuilder;
-import org.hyperledger.besu.crypto.KeyPairUtil;
+import org.hyperledger.besu.crypto.NodeKey;
 import org.hyperledger.besu.enclave.EnclaveFactory;
 import org.hyperledger.besu.ethereum.api.graphql.GraphQLConfiguration;
 import org.hyperledger.besu.ethereum.api.jsonrpc.JsonRpcConfiguration;
@@ -108,16 +107,20 @@
 import org.hyperledger.besu.plugin.services.BesuEvents;
 import org.hyperledger.besu.plugin.services.MetricsSystem;
 import org.hyperledger.besu.plugin.services.PicoCLIOptions;
+import org.hyperledger.besu.plugin.services.SecurityModuleService;
 import org.hyperledger.besu.plugin.services.StorageService;
 import org.hyperledger.besu.plugin.services.exception.StorageException;
 import org.hyperledger.besu.plugin.services.metrics.MetricCategory;
 import org.hyperledger.besu.plugin.services.metrics.MetricCategoryRegistry;
+import org.hyperledger.besu.plugin.services.securitymodule.SecurityModule;
+import org.hyperledger.besu.plugin.services.securitymodule.bouncycastle.BouncyCastleSecurityModulePlugin;
 import org.hyperledger.besu.plugin.services.storage.PrivacyKeyValueStorageFactory;
 import org.hyperledger.besu.plugin.services.storage.rocksdb.RocksDBPlugin;
 import org.hyperledger.besu.services.BesuConfigurationImpl;
 import org.hyperledger.besu.services.BesuEventsImpl;
 import org.hyperledger.besu.services.BesuPluginContextImpl;
 import org.hyperledger.besu.services.PicoCLIOptionsImpl;
+import org.hyperledger.besu.services.SecurityModuleServiceImpl;
 import org.hyperledger.besu.services.StorageServiceImpl;
 import org.hyperledger.besu.util.NetworkUtility;
 import org.hyperledger.besu.util.PermissioningConfigurationValidator;
@@ -199,15 +202,12 @@ public class BesuCommand implements DefaultCommandValues, Runnable {
   private final BesuController.Builder controllerBuilderFactory;
   private final BesuPluginContextImpl besuPluginContext;
   private final StorageServiceImpl storageService;
+  private final SecurityModuleServiceImpl securityModuleService;
   private final Map<String, String> environment;
   private final MetricCategoryRegistryImpl metricCategoryRegistry =
       new MetricCategoryRegistryImpl();
   private final MetricCategoryConverter metricCategoryConverter = new MetricCategoryConverter();
 
-  protected KeyLoader getKeyLoader() {
-    return KeyPairUtil::loadKeyPair;
-  }
-
   // Public IP stored to prevent having to research it each time we need it.
   private InetAddress autoDiscoveredDefaultIP = null;
 
@@ -813,6 +813,13 @@ void setBannedNodeIds(final List<String> values) {
       arity = "1")
   private String keyValueStorageName = DEFAULT_KEY_VALUE_STORAGE_NAME;
 
+  @SuppressWarnings({"FieldCanBeFinal", "FieldMayBeFinal"})
+  @Option(
+      names = {"--security-module-provider"},
+      description = "Identity for the Security Module provider to be used.",
+      arity = "1")
+  private String nodeKeySecurityModuleProviderName = DEFAULT_NODEKEY_SECURITY_MODULE_PROVIDER;
+
   @Option(
       names = {"--auto-log-bloom-caching-enabled"},
       description = "Enable automatic log bloom caching (default: ${DEFAULT-VALUE})",
@@ -858,6 +865,7 @@ void setBannedNodeIds(final List<String> values) {
   private BesuController<?> besuController;
   private StandaloneCommand standaloneCommands;
   private BesuConfiguration pluginCommonConfiguration;
+  private NodeKey nodeKey;
   private final Supplier<ObservableMetricsSystem> metricsSystem =
       Suppliers.memoize(() -> PrometheusMetricsSystem.init(metricsConfiguration()));
   private Vertx vertx;
@@ -880,7 +888,8 @@ public BesuCommand(
         controllerBuilderFactory,
         besuPluginContext,
         environment,
-        new StorageServiceImpl());
+        new StorageServiceImpl(),
+        new SecurityModuleServiceImpl());
   }
 
   @VisibleForTesting
@@ -893,7 +902,8 @@ protected BesuCommand(
       final BesuController.Builder controllerBuilderFactory,
       final BesuPluginContextImpl besuPluginContext,
       final Map<String, String> environment,
-      final StorageServiceImpl storageService) {
+      final StorageServiceImpl storageService,
+      final SecurityModuleServiceImpl securityModuleService) {
     this.logger = logger;
     this.rlpBlockImporter = rlpBlockImporter;
     this.rlpBlockExporterFactory = rlpBlockExporterFactory;
@@ -903,6 +913,7 @@ protected BesuCommand(
     this.besuPluginContext = besuPluginContext;
     this.environment = environment;
     this.storageService = storageService;
+    this.securityModuleService = securityModuleService;
   }
 
   public void parse(
@@ -949,6 +960,17 @@ private void addConfigurationService() {
     }
   }
 
+  /* NOTE: Must be called after addConfigurationService */
+  private void addNodeKey() {
+    if (nodeKey == null) {
+      nodeKey = new NodeKey(nodeKeySecurityModuleProvider(nodeKeySecurityModuleProviderName));
+    }
+  }
+
+  public Optional<NodeKey> getNodeKey() {
+    return Optional.ofNullable(nodeKey);
+  }
+
   @VisibleForTesting
   void setBesuConfiguration(final BesuConfiguration pluginCommonConfiguration) {
     this.pluginCommonConfiguration = pluginCommonConfiguration;
@@ -978,8 +1000,7 @@ private BesuCommand addSubCommands(
             rlpBlockExporterFactory,
             resultHandler.out()));
     commandLine.addSubcommand(
-        PublicKeySubCommand.COMMAND_NAME,
-        new PublicKeySubCommand(resultHandler.out(), getKeyLoader()));
+        PublicKeySubCommand.COMMAND_NAME, new PublicKeySubCommand(resultHandler.out()));
     commandLine.addSubcommand(
         PasswordSubCommand.COMMAND_NAME, new PasswordSubCommand(resultHandler.out()));
     commandLine.addSubcommand(RetestethSubCommand.COMMAND_NAME, new RetestethSubCommand());
@@ -1025,11 +1046,11 @@ private BesuCommand handleUnstableOptions() {
 
   private BesuCommand preparePlugins() {
     besuPluginContext.addService(PicoCLIOptions.class, new PicoCLIOptionsImpl(commandLine));
+    besuPluginContext.addService(SecurityModuleService.class, securityModuleService);
     besuPluginContext.addService(StorageService.class, storageService);
     besuPluginContext.addService(MetricCategoryRegistry.class, metricCategoryRegistry);
 
-    // register built-in plugins
-    new RocksDBPlugin().register(besuPluginContext);
+    registerBuiltInPlugins();
 
     besuPluginContext.registerPlugins(pluginsDir());
 
@@ -1040,6 +1061,11 @@ private BesuCommand preparePlugins() {
     return this;
   }
 
+  private void registerBuiltInPlugins() {
+    new RocksDBPlugin().register(besuPluginContext);
+    new BouncyCastleSecurityModulePlugin().register(besuPluginContext);
+  }
+
   private void parse(
       final AbstractParseResultHandler<List<Object>> resultHandler,
       final BesuExceptionHandler exceptionHandler,
@@ -1225,6 +1251,7 @@ public BesuController<?> buildController() {
 
   public BesuControllerBuilder<?> getControllerBuilder() {
     addConfigurationService();
+    addNodeKey();
     return controllerBuilderFactory
         .fromEthNetworkConfig(updateNetworkConfig(getNetwork()), genesisConfigOverrides)
         .synchronizerConfiguration(buildSyncConfig())
@@ -1242,7 +1269,7 @@ public BesuControllerBuilder<?> getControllerBuilder() {
                 stratumExtranonce,
                 Optional.empty()))
         .transactionPoolConfiguration(buildTransactionPoolConfiguration())
-        .nodePrivateKeyFile(nodePrivateKeyFile())
+        .nodeKey(nodeKey)
         .metricsSystem(metricsSystem.get())
         .privacyParameters(privacyParameters())
         .clock(Clock.systemUTC())
@@ -1937,15 +1964,11 @@ private Path pluginsDir() {
     }
   }
 
-  public File nodePrivateKeyFile() {
-    File nodePrivateKeyFile = null;
-    if (isFullInstantiation()) {
-      nodePrivateKeyFile = standaloneCommands.nodePrivateKeyFile;
-    }
-
-    return nodePrivateKeyFile != null
-        ? nodePrivateKeyFile
-        : KeyPairUtil.getDefaultKeyFile(dataDir());
+  private SecurityModule nodeKeySecurityModuleProvider(final String name) {
+    return securityModuleService
+        .getByName(name)
+        .orElseThrow(() -> new RuntimeException("Node Key Security Module not found: " + name))
+        .apply(pluginCommonConfiguration);
   }
 
   private File privacyPublicKeyFile() {

besu/src/main/java/org/hyperledger/besu/cli/DefaultCommandValues.java

@@ -70,6 +70,7 @@ public interface DefaultCommandValues {
   float DEFAULT_FRACTION_REMOTE_WIRE_CONNECTIONS_ALLOWED =
       RlpxConfiguration.DEFAULT_FRACTION_REMOTE_CONNECTIONS_ALLOWED;
   String DEFAULT_KEY_VALUE_STORAGE_NAME = "rocksdb";
+  String DEFAULT_NODEKEY_SECURITY_MODULE_PROVIDER = "bouncycastle";
 
   static Path getDefaultBesuDataPath(final Object command) {
     // this property is retrieved from Gradle tasks or Besu running shell script.

besu/src/main/java/org/hyperledger/besu/cli/StandaloneCommand.java

@@ -50,13 +50,6 @@ class StandaloneCommand implements DefaultCommandValues {
           "Genesis file. Setting this option makes --network option ignored and requires --network-id to be set.")
   final File genesisFile = null;
 
-  @CommandLine.Option(
-      names = {"--node-private-key-file"},
-      paramLabel = MANDATORY_PATH_FORMAT_HELP,
-      description =
-          "The node's private key file (default: a file named \"key\" in the Besu data folder)")
-  final File nodePrivateKeyFile = null;
-
   @CommandLine.Option(
       names = {"--rpc-http-authentication-credentials-file"},
       paramLabel = MANDATORY_FILE_FORMAT_HELP,