Op-stack remote signer for p2p sequencer, batcher and proposer

[slon2015]

Hello. I'm representative of the Scalind team. We are looking for a design for the remote signer feature in op-node, batcher, and proposer services.

The new feature consists of:

• A signer service implementation
• The signer-opservice interaction protocol
• The signer-opservice auth mechanism

The feature requirements

• Op-node should run with enabled sequencer without sequencer private key
• Batcher and proposer should run with signer options as usual
• Batcher and proposer may authenticate signer requests with additional args/envs
• Signer should support remote/hardware key storage(s) for security purposes
• The node may authenticate the sign requests with the auth mechanism, for malicious TX sign prevention
• The signer should implement an authorization mechanism that authorizes particular opservices to use specific addresses to sign

Has anyone already implemented that? Which services we could use for the signer? How we could build the auth mechanism?
How we could store the private keys? Shall we expand the requirements list?

[slon2015]

The Scalind vision:

We could use the fork of https://github.com/Consensys/ethsigner as the signer service.
It's already implemented the tx sign json-rpc endpoint. In addition for this code, we should implement json-rpc endpoint for sequencer message signs.
For the auth, we could use the jwt token with an asymmetric cryptography algorithm. The system owner creates the token from its private key.
The token consists of claims:

• jti. Randomly generated UUID. The signer could blacklist specific tokens by its jti
• txSignAddresses. The list of hashes of the Ethereum addresses, that could be used for tx sign. When the signer receives a signTx request, it checks the inclusion of the requested address hash in the txSignAddresses claim
• sequencerAddress. The single Ethereum address hash. Could be empty. When the signer receives the sequencerSign request, it compares the requested address hash with the sequencerAddress claim

The auth mechanism should be implemented in the forked ethsigner.

The remote storage of the private keys is already implemented in the original ethsigner. But it could be expanded with hardware wallets.

This vision is still a draft of the final feature design. Feel free to correct this vision, propose your own, and discuss the requirements and components of the feature.

[slon2015]

@protolambda I've seen your comments there https://github.com/ethereum-optimism/optimism/blame/develop/op-node/p2p/cli/load_signer.go#L14
Do you have any idea or prototypes of remote signer for the op-node?