# \[ANN\] Tendermint KMS v0.0.1 Preview Release with initial YubiHSM2 support **URL:** \ **Category:** Validation\ **Created:** [October 18, 2018, 2:02pm UTC](https://forum.cosmos.network/t/ann-tendermint-kms-v0-0-1-preview-release-with-initial-yubihsm2-support/1218 "2018-10-18T14:02:55Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![iqlusion](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/iqlusion/32/294_2.png) [@iqlusion](https://forum.cosmos.network/u/iqlusion)\ **Post date:** [October 18, 2018, 2:02pm UTC](https://forum.cosmos.network/t/ann-tendermint-kms-v0-0-1-preview-release-with-initial-yubihsm2-support/1218/1 "2018-10-18T14:02:55Z")
_NOTE: This release does not yet support validator signing! For progress on that, please watch [PR#55](https://github.com/tendermint/kms/pull/55) on the KMS repo, which is the last hurdle for unlocking this capability._ [Tendermint Key Management System (KMS)](https://github.com/tendermint/kms/), a.k.a. `tmkms`, is an interface to Hardware Security Modules (HSMs), namely [YubiHSM2](https://www.yubico.com/products/yubihsm/) devices from Yubico, and soon, the [Ledger Nano S](https://www.ledger.com/products/ledger-nano-s). It’s intended to be run alongside Cosmos Validators, ideally on separate physical hosts, providing defense-in-depth for online validator signing keys as well as a central signing service that can be used when operating multiple validators in several Cosmos Zones. We’ve just released `tmkms` v0.0.1 which contains an initial preview of the KMS’s functionality. Specifically, this release is capable of generating and listing keys within YubiHSM2s as well as a signing stress test to ensure the software is stable and robust. As noted at the top of this post, it cannot _yet_ be used for validator signing, but we are very close to landing that functionality (hopefully in the next few days). The current release is a bit rough around the edges and doesn’t yet have full functionality, but we’re releasing early so you can start playing around with it. This thread provides a quick tour of the available functionality, as well as the steps needed to install Tendermint KMS. ## Installation _NOTE: A detailed installation guide is also available in the [README](https://github.com/tendermint/kms/blob/master/README.md#installation). See also: [Supported Platforms](https://github.com/tendermint/kms/blob/master/README.md#supported-platforms)_. The following is a step-by-step guide to install the initial release of the KMS. These instructions will largely remain the same for future versions of the KMS. ### 1. Install Rust `tmkms` is written in Rust and you will need a Rust compiler to install it. There are two ways to install the Rust compiler: **a. rustup** The [rustup utility](https://rustup.rs/) provides a simple and convenient way to install Rust: ```auto $ curl https://sh.rustup.rs -sSf | sh ``` **b. OS packages** The Rust compiler has been packaged by several operating systems. Exact install instructions will depend on your OS, but here are a few common options: - Debian/Ubuntu: `apt install rustc cargo` - RedHat/CentOS: See [https://www.softwarecollections.org/en/scls/rhscl/rust-toolset-7/](https://www.softwarecollections.org/en/scls/rhscl/rust-toolset-7/) ### 2. Install C compiler and pkg-config You will need a C compiler for your OS (i.e. gcc or clang), as well as the `pkg-config` utility installed in order to compile the KMS. ### 3. Install libusb KMS uses `libusb` to communicate with HSMs. You will need to have it installed in order for KMS to compile: [https://libusb.info/](https://libusb.info/) Make sure to install libusb 1.0+! Detailed instructions for installing proper libusb versions can be found in the [tmkms README’s Install section](https://github.com/tendermint/kms/blob/master/README.md#installation). ### 4. Install `tmkms` using cargo Run the following command to install `tmkms` using Rust’s “cargo” packaging utility: ```auto $ cargo install tmkms ``` After running this you should see the following: ```auto $ cargo install tmkms Updating registry `https://github.com/rust-lang/crates.io-index` Installing tmkms v0.0.1 [...] Compiling tmkms v0.0.1 Finished release [optimized] target(s) in 1m 34s ``` After this is complete, `tmkms` is installed! ## Configuration `tmkms` uses a configuration file called `tmkms.toml`, which by default it looks for in the same directory as the KMS was launched from, or you can override the path with the `-c /path/to/kms.toml` command line argument. An example `tmkms.toml` file can be found at: > ## YubiHSM2 Setup _NOTE: A more powerful YubiHSM2 setup subcommand is coming to `tmkms` soon! Stay tuned for details._ `tmkms` contains (almost) everything you need to set up a YubiHSM2 from scratch in a self-contained way with no additional utilities. The instructions below take you through the setup process step-by-step. ### 1. Detect YubiHSM2 The `tmkms yubihsm detect` subcommand can be used to locate your YubiHSM2: ![tmkms%20yubihsm%20detect](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/9e0dbd63396cc60148e0ef297c99f6cc7dc7a99b.png) Passing the `-v` command-line argument enables detailed debugging information: ![tmkms%20yubihsm%20detect%20debug](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/aa533bbddbe056ac07d959c494a4dcaaeb8216f4.png) ### 2. Generate Ed25519 signing key All YubiHSM key management commands are available under the `tmkms yubihsm keys` subcommand. Run `tmkms yubihsm keys help` for more information. The `tmkms yubihsm keys generate` subcommand can be used to generate an HSM-backed signing key, (soon) suitable for use as your validator key. Every key in the YubiHSM2 has a numbered ID between 1-65535. Since we’re generating the first key in this HSM, we’ll use key ID #1: ![tmkms%20yubihsm%20keys%20generate](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/7857c1c6c478a32e3a15f39966ec77d6e5c9154f.png) If you see this, you’ve successfully generated your first private signing key in the YubiHSM2! ### 3. List signing keys The `tmkms yubihsm keys list` subcommand will list all keys in the detected HSM: ![tmkms%20yubihsm%20keys%20list](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/c37c01d0100ac860419590f70d88d4fcde5e23b0.png) ### 4. Run signing stress test The `tmkms yubihsm test` subcommand performs a stress test against the YubiHSM2. It takes the key ID# of a signing key to use for the test as an argument. Since we just created key #1, that’s what we’ll pass as an argument: ![tmkms%20yubihsm%20test](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/18eae7e62716ddf1776b0b057512783e4c370764.png) Pass `-v` to enable detailed debugging: ![tmkms%20yubihsm%20test%20debug](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/400e4927770b1270f7bab12b9d7086650fdea4cf.png) The stress test should continue running even if signing errors occur. This means you should be able to remove the YubiHSM2 from its USB slot and reinsert it (potentially in a different slot!) and signing should immediately resume when it becomes available again: ![tmkms%20yubihsm%20test%20error](https://canada1.discourse-cdn.com/flex031/uploads/cosmos1/original/1X/6410e9494a5be6237521de029b54bb637a02f7a0.png) If `tmkms yubihsm test` crashes instead of resuming signing, you have found a critical bug! In the event this does happen, please [open an issue on the tmkms GitHub issue tracker](https://github.com/tendermint/kms/issues). Thanks for reading this, and please post in this thread if you need help or even just to let us know that it’s working for you. ---
**Author:** ![mattharrop](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@mattharrop](https://forum.cosmos.network/u/mattharrop)\ **Post date:** [October 18, 2018, 6:20pm UTC](https://forum.cosmos.network/t/ann-tendermint-kms-v0-0-1-preview-release-with-initial-yubihsm2-support/1218/2 "2018-10-18T18:20:33Z")
Very cool. All working well on Ubuntu 18.04lts. Only complication was a little bit of USB permission twiddling required. The stress test works fine, including pulling and replacing the YubiHSM2. Success signed message using key ID #1 in 142 ms Success signed message using key ID #1 in 142 ms Success signed message using key ID #1 in 142 ms error: signature operation failed: protocol error: I/O error: Input/Output Error error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected error: signature operation failed: protocol error: USB error: no YubiHSM2 devices detected Success signed message using key ID #1 in 714 ms Success signed message using key ID #1 in 142 ms Success signed message using key ID #1 in 142 ms ---
**Author:** ![HumanPeace](https://avatars.discourse-cdn.com/v4/letter/h/e9bcb4/32.png) [@HumanPeace](https://forum.cosmos.network/u/HumanPeace)\ **Post date:** [October 26, 2018, 11:57am UTC](https://forum.cosmos.network/t/ann-tendermint-kms-v0-0-1-preview-release-with-initial-yubihsm2-support/1218/3 "2018-10-26T11:57:25Z")
serial: #000755\_80\_72 ? ---
**Author:** ![mattharrop](https://avatars.discourse-cdn.com/v4/letter/m/58956e/32.png) [@mattharrop](https://forum.cosmos.network/u/mattharrop)\ **Post date:** [November 19, 2018, 9:48pm UTC](https://forum.cosmos.network/t/ann-tendermint-kms-v0-0-1-preview-release-with-initial-yubihsm2-support/1218/4 "2018-11-19T21:48:12Z")
Is there any information about configuring gaiad & the KMS 0.1.0 to work together? ---
**Author:** ![iqlusion](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.cosmos.network/iqlusion/32/294_2.png) [@iqlusion](https://forum.cosmos.network/u/iqlusion)\ **Post date:** [November 19, 2018, 10:47pm UTC](https://forum.cosmos.network/t/ann-tendermint-kms-v0-0-1-preview-release-with-initial-yubihsm2-support/1218/5 "2018-11-19T22:47:00Z")
Hi @mattharrop, I’m planning on doing another release (v0.2) either later today or tomorrow with updates to the configuration file syntax, and have been holding off on making a bigger announcement until that happens. Stay tuned though!