[−][src]Crate yubihsm
yubihsm.rs: pure Rust client for YubiHSM2 hardware security modules
Prerequisites
This crate builds on Rust 1.31+ and by default uses SIMD features
which require the following RUSTFLAGS:
RUSTFLAGS=-Ctarget-feature=+aes,+ssse3
You can configure your ~/.cargo/config to always pass these flags:
[build]
rustflags = ["-Ctarget-feature=+aes,+ssse3"]
Getting Started
The following documentation describes the most important parts of this crate's API:
- yubihsm::connector: methods of connecting to a YubiHSM (USB or HTTP via yubihsm-connector)
- yubihsm::Client: client providing wrappers for YubiHSM commands.
Example
The following is an example of how to create a yubihsm::Client by connecting via USB, and then performing an Ed25519 signature:
extern crate yubihsm;
use yubihsm::{Client, Credentials, UsbConnector};
// Connect to the first YubiHSM2 we detect
let connector = UsbConnector::default();
// Default auth key ID and password for YubiHSM2
// NOTE: DON'T USE THIS IN PRODUCTION!
let credentials = Credentials::default();
// Connect to the HSM and authenticate with the given credentials
let mut hsm_client = Client::open(connector, credentials, true).unwrap();
// Note: You'll need to create this key first. Run the following from yubihsm-shell:
// `generate asymmetric 0 100 ed25519_test_key 1 asymmetric_sign_eddsa ed25519`
let signature = hsm_client.sign_ed25519(100, "Hello, world!").unwrap();
println!("Ed25519 signature: {:?}", signature);
Re-exports
pub use crate::connector::http::HttpConnector; |
pub use crate::connector::usb::UsbConnector; |
pub use crate::mockhsm::MockHsm; |
pub use crate::algorithm::*; |
pub use crate::capability::Capability; |
pub use crate::client::Client; |
pub use crate::connector::Connection; |
pub use crate::connector::Connector; |
pub use crate::domain::Domain; |
pub use crate::error::*; |
pub use crate::object::*; |
Modules
| algorithm | Cryptographic algorithms supported by the HSM |
| authentication | YubiHSM2 authentication functionality (i.e. credentials used to authenticate and establish a session with an HSM) |
| capability | Object attributes specifying which operations are allowed to be performed |
| client | YubiHSM client: main functionality of this crate YubiHSM client: core functionality of this crate. |
| command | Commands supported by the HSM. |
| connector | Methods of connecting to a YubiHSM2: |
| domain | Logical partitions within the HSM, allowing several applications to share the device. |
| error | Error types |
| mockhsm | Simulation of the HSM for integration testing. |
| object | Objects stored in the HSM. |
| response | Responses to command sent from the HSM. |
| session | Authenticated/encrypted sessions with the HSM. |
| setup | Device provisioning support including creating initial accounts and wrap keys Initial YubiHSM2 setup functionality using declarative device profiles. |
| signatory | Implementations of the Signatory abstract signature API |
| wrap | Support for initial HSM provisioning including creating authentication keys, wrap keys, and configuring auditing Object wrapping support, i.e. encrypt objects from one HSM to another. "Wrapping" support: YubiHSM2 key/object encryption for backups and importing existing keys to other derivces. |
Structs
| Credentials | Credentials used to establish a session with the HSM |
| HttpConfig | Configuration options for the HTTP (i.e. |
| SerialNumber | YubiHSM serial numbers |
| UsbConfig | Configuration for connecting to the YubiHSM via USB |
| Uuid | A Universally Unique Identifier (UUID). |
Enums
| AuditOption | Auditing policy options |
Constants
| AUTHENTICATION_KEY_SIZE | Auth keys are 2 * AES-128 keys |
Type Definitions
| ClientError | Session errors |
| ConnectionError |
|