Skip to content

Commit

Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Adds support for YubiHSM Auth
Browse files Browse the repository at this point in the history
This adds support for the YubiHSM Auth protocol as described in
https://docs.yubico.com/yesdk/users-manual/application-yubihsm-auth/interacting-yubihsm-2.html

This protocol ensure the derivation password for the authentication keys are kept
in secure devices.
baloo committed Dec 30, 2023
1 parent c597e83 commit 9da3725
Showing 8 changed files with 459 additions and 82 deletions.
26 changes: 18 additions & 8 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -11,15 +11,22 @@ env:

jobs:
build:
runs-on: ubuntu-latest
strategy:
matrix:
platform:
- ubuntu-latest
- macos-latest
toolchain:
- stable
- 1.67.0 # MSRV
include:
- platform: ubuntu-latest
toolchain: stable
deps: sudo apt-get install libpcsclite-dev
- platform: macos-latest
toolchain: stable
deps: true
- platform: ubuntu-latest
toolchain: 1.67.0 # MSRV
deps: sudo apt-get install libpcsclite-dev
- platform: macos-latest
toolchain: 1.67.0 # MSRV
deps: true
runs-on: ${{ matrix.platform }}
steps:
- uses: actions/checkout@v1
- name: cache .cargo/registry
@@ -41,14 +48,15 @@ jobs:
with:
toolchain: ${{ matrix.toolchain }}
override: true
- run: ${{ matrix.deps }}
- run: cargo build --release
- run: cargo build --release --no-default-features
- run: cargo build --release --no-default-features --features=passwords
- run: cargo build --release --features=usb
- run: cargo build --release --features=yubihsm-auth
- run: cargo build --benches

test:
runs-on: ubuntu-latest
strategy:
matrix:
platform:
@@ -57,6 +65,7 @@ jobs:
toolchain:
- stable
- 1.67.0 # MSRV
runs-on: ${{ matrix.platform }}
steps:
- uses: actions/checkout@v1
- name: cache .cargo/registry
@@ -103,6 +112,7 @@ jobs:
toolchain: 1.71.0 # pinned to prevent CI breakages
components: clippy
override: true
- run: sudo apt-get install libpcsclite-dev
- uses: actions-rs/cargo@v1
with:
command: clippy
114 changes: 113 additions & 1 deletion Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -49,6 +49,7 @@ pbkdf2 = { version = "0.12", optional = true, default-features = false, features
serde_json = { version = "1", optional = true }
rusb = { version = "0.9", optional = true }
tiny_http = { version = "0.12", optional = true }
yubikey = { git = "https://github.com/baloo/yubikey.rs", branch = "baloo/yubihsm-auth", optional = true }

[dev-dependencies]
ed25519-dalek = "2"
@@ -66,6 +67,7 @@ secp256k1 = ["k256"]
setup = ["passwords", "serde_json", "uuid/serde"]
untested = []
usb = ["rusb"]
yubihsm-auth = ["yubikey"]

[package.metadata.docs.rs]
all-features = true
29 changes: 29 additions & 0 deletions src/client.rs
Original file line number Diff line number Diff line change
@@ -43,6 +43,9 @@ use std::{
#[cfg(feature = "passwords")]
use std::{thread, time::SystemTime};

#[cfg(feature = "yubihsm-auth")]
use crate::session::PendingSession;

#[cfg(feature = "untested")]
use {
crate::{
@@ -106,6 +109,20 @@ impl Client {
Ok(client)
}

/// Open session with YubiHSM Auth scheme
#[cfg(feature = "yubihsm-auth")]
pub fn yubihsm_auth(
connector: Connector,
authentication_key_id: object::Id,
host_challenge: session::securechannel::Challenge,
) -> Result<PendingSession, Error> {
let timeout = session::Timeout::default();

let session =
PendingSession::new(connector, timeout, authentication_key_id, host_challenge)?;
Ok(session)
}

/// Borrow this client's YubiHSM connector (which is `Clone`able)
pub fn connector(&self) -> &Connector {
&self.connector
@@ -1165,3 +1182,15 @@ impl Client {
.0)
}
}

impl From<Session> for Client {
fn from(session: Session) -> Self {
let connector = session.connector();
let session = Arc::new(Mutex::new(Some(session)));
Self {
connector,
session,
credentials: None,
}
}
}
Loading

0 comments on commit 9da3725

Please sign in to comment.