YubiHSM2s support advanced auditing features: they retain an audit log (which can be permanently set to on), and can enforce the log must be consumed before additional operations can be performed.

It would nice to be able to retain these audits, and additional information about each signature performed (e.g. current block height) in an external auditing service.

This could potentially be used for a double-signing defense: the KMS could potentially consult with the auditing service to determine the last block height signed.

Launch Plan (Tentative)

The KMS can support an user-configurable auditing subcommand:

• KMS executes auditing subcommand each time a signing operation is performed
• Subcommand is given signing request and signature (via e.g. stdin). Optionally it could also be given the YubiHSM2 audit event/audit log.
• If auditing subcommand exits with an error, signature operation is aborted and an error is returned to the validator (possibly as a configurable option, i.e. fail open vs fail closed)