Quick Start

go get github.com/luxfi/hsm@latest

// Local signer for development
signer, err := hsm.NewSigner("local", nil)

// AWS KMS for production
signer, err := hsm.NewSigner("aws", map[string]string{
    "region": "us-east-1",
})

// Post-quantum ML-DSA
signer, err := hsm.NewSigner("mldsa", nil)

ctx := context.Background()
message := []byte("transaction payload")

signature, err := signer.Sign(ctx, "my-key-id", message)
if err != nil {
    log.Fatal(err)
}

valid, err := signer.Verify(ctx, "my-key-id", message, signature)
if err != nil {
    log.Fatal(err)
}
fmt.Println("Signature valid:", valid)

mgr, err := hsm.New(hsm.Config{
    PasswordProvider: "aws",
    SignerProvider:   "aws",
    SignerKeyID:      "arn:aws:kms:us-east-1:123456789:key/sign-key",
    Region:           "us-east-1",
})
if err != nil {
    log.Fatal(err)
}

// Sign with the configured default key
sig, _ := mgr.Sign(ctx, []byte("payload"))

// Verify
ok, _ := mgr.Verify(ctx, []byte("payload"), sig)

// Get ZapDB password
password, _ := mgr.GetPassword(ctx)