yubihsm 0.20.0

Pure Rust client for YubiHSM2 devices with support for HTTP and USB-based access to the device. Supports most HSM functionality including ECDSA, Ed25519, HMAC, and RSA.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

use failure::Error;
#[cfg(feature = "mockhsm")]
use rand_os::{rand_core::RngCore, OsRng};
use std::fmt;

/// Number of bytes in a nonce used for "wrapping" (i.e AES-CCM encryption)
pub const WRAP_NONCE_SIZE: usize = 13;

/// Message (either object or arbitrary data) encrypted under a wrap key
#[derive(Serialize, Deserialize, Debug, Clone)]
pub struct WrapMessage {
    /// Nonce used to encrypt the wrapped data
    pub nonce: WrapNonce,

    /// Ciphertext of the encrypted object
    pub ciphertext: Vec<u8>,
}

impl WrapMessage {
    /// Load a `WrapMessage` from a byte vector
    pub fn from_vec(mut vec: Vec<u8>) -> Result<Self, Error> {
        if vec.len() < WRAP_NONCE_SIZE {
            bail!("message must be at least {}-bytes", WRAP_NONCE_SIZE);
        }

        let mut nonce = [0u8; WRAP_NONCE_SIZE];
        nonce.copy_from_slice(vec.split_off(WRAP_NONCE_SIZE).as_ref());

        Ok(Self::new(nonce, vec))
    }

    /// Create a new `WrapMessage`
    pub fn new<N, V>(nonce: N, ciphertext: V) -> Self
    where
        N: Into<WrapNonce>,
        V: Into<Vec<u8>>,
    {
        Self {
            nonce: nonce.into(),
            ciphertext: ciphertext.into(),
        }
    }

    /// Convert this message into a byte vector
    pub fn into_vec(self) -> Vec<u8> {
        self.into()
    }
}

impl Into<Vec<u8>> for WrapMessage {
    fn into(self) -> Vec<u8> {
        let WrapMessage {
            nonce,
            mut ciphertext,
        } = self;

        let mut vec = Vec::with_capacity(WRAP_NONCE_SIZE + ciphertext.len());
        vec.extend_from_slice(nonce.as_ref());
        vec.append(&mut ciphertext);

        vec
    }
}

/// Nonces for AES-CCM keywrapping
#[derive(Debug, Clone)]
pub struct WrapNonce(pub [u8; WRAP_NONCE_SIZE]);

impl WrapNonce {
    /// Generate a random `WrapNonce`
    #[cfg(feature = "mockhsm")]
    pub fn generate() -> Self {
        let mut rand = OsRng::new().unwrap();
        let mut bytes = [0u8; WRAP_NONCE_SIZE];
        rand.fill_bytes(&mut bytes);
        WrapNonce(bytes)
    }
}

impl AsRef<[u8]> for WrapNonce {
    fn as_ref(&self) -> &[u8] {
        &self.0
    }
}

impl From<[u8; WRAP_NONCE_SIZE]> for WrapNonce {
    fn from(bytes: [u8; WRAP_NONCE_SIZE]) -> WrapNonce {
        WrapNonce(bytes)
    }
}

impl_array_serializers!(WrapNonce, WRAP_NONCE_SIZE);