Lux HSM - Unified Hardware Security Module Integration

// Signer provides asymmetric signing and verification using HSM-backed keys.
type Signer interface {
    Sign(ctx context.Context, keyID string, message []byte) ([]byte, error)
    Verify(ctx context.Context, keyID string, message, signature []byte) (bool, error)
    Provider() string
}

// PasswordProvider retrieves or derives a decrypted password string.
type PasswordProvider interface {
    GetPassword(ctx context.Context, keyID string) (string, error)
}

cfg := hsm.Config{
    PasswordProvider: "aws",
    PasswordKeyID:    "arn:aws:kms:us-east-1:...",
    SignerProvider:   "aws",
    SignerKeyID:      "arn:aws:kms:us-east-1:...",
    Region:           "us-east-1",
}
mgr, err := hsm.New(cfg)

password, err := mgr.GetPassword(ctx)         // Decrypt ZapDB password
sig, err := mgr.Sign(ctx, message)             // Sign with default key
sig, err := mgr.SignWithKey(ctx, keyID, msg)   // Sign with specific key
ok, err := mgr.Verify(ctx, message, sig)       // Verify with default key

// Create signer directly (no Manager overhead)
signer, err := hsm.NewSigner("mldsa", nil)
sig, err := signer.Sign(ctx, "my-key", message)

// Create password provider directly
pw, err := hsm.NewPasswordProvider("env", map[string]string{"env_var": "MY_DB_PASSWORD"})
password, err := pw.GetPassword(ctx, "")

signer := hsm.NewMLDSASigner(mldsa.MLDSA65) // NIST Level 3, 192-bit PQ security
sig, err := signer.Sign(ctx, "validator-0", message)
ok, err := signer.Verify(ctx, "validator-0", message, sig)

vault := hsm.NewKeyShareVault(passwordProvider, "kms-key-id")
vault.Store(ctx, "validator-0", share.Bytes(), meta)
raw, meta, err := vault.Load(ctx, "validator-0")

signer := hsm.NewAttestingSigner(inner, hsmSigner, "attestation-key")
share, _ := signer.SignShare(ctx, message, signers, nonce)
ok, _ := hsm.VerifyAttestation(ctx, hsmSigner, "attestation-key", share)

type ThresholdHSM interface {
    Signer
    NonceGen(ctx context.Context, keyID, sessionID string) (commitment []byte, nonceRef string, err error)
    SignThresholdShare(ctx context.Context, keyID, sessionID, nonceRef string, message []byte, signerIndices []int) ([]byte, error)
    ImportKeyShare(ctx context.Context, keyID string, share []byte) error
    ExportPublicShare(ctx context.Context, keyID string) ([]byte, error)
}

hsm/
  hsm.go                    -- Package doc, consolidation overview
  signer.go                 -- Signer + PasswordProvider interfaces
  factory.go                -- NewSigner() + NewPasswordProvider() factories
  manager.go                -- Manager: unified Config + Sign/Verify/GetPassword
  auth_helpers.go           -- AWS SigV4, GCP metadata token, Azure MSI token
  password_providers.go     -- AWSKMSProvider, GCPKMSProvider, AzureKVProvider, EnvProvider, FileProvider
  signer_aws.go             -- AWS KMS signer (ECDSA_SHA_256)
  signer_gcp.go             -- GCP KMS signer (EC_SIGN_P256_SHA256)
  signer_azure.go           -- Azure Key Vault signer
  signer_zymbit.go          -- Zymbit SCM signer (local PKCS#11, port 6789)
  signer_mldsa.go           -- ML-DSA post-quantum signer (FIPS 204 via circl)
  signer_local.go           -- In-memory ECDSA P-256 (dev only)
  threshold_adapter.go      -- ThresholdHSM, KeyShareVault, HSMAttestingSigner, ThresholdManager
  threshold_adapter_test.go -- Tests for threshold integration
  hsm_test.go               -- Tests for all providers and manager

go test ./... -v