Crate yb_core 

Core library for yb — secure blob storage on a YubiKey.

Quick start

use yb_core::{store::Store, orchestrator, Context, ContextOptions, OutputOptions};

let ctx = Context::new(ContextOptions { pin: Some("123456".into()), ..Default::default() }, Box::new(|| Ok(None)), Box::new(|_, _| Ok(None)), OutputOptions::default())?;
let store = Store::from_device(&ctx.reader, ctx.piv.as_ref())?;
for blob in orchestrator::list_blobs(&store) {
    println!("{} ({} bytes)", blob.name, blob.plain_size);
}
let data = orchestrator::fetch_blob(
    &store, ctx.piv.as_ref(), &ctx.reader, "my-secret", ctx.require_pin()?.as_deref(), false,
)?;

Features

Feature	Purpose	Default
chrono	BlobInfo::mtime_local() convenience method	No
virtual-piv	VirtualPiv in-memory backend for testing	No
integration-tests	vsmartcard + piv-authenticator tests	No
hardware-tests	Real YubiKey destructive tests	No

Security note

Private key material on the YubiKey is never extracted. ECDH key agreement is performed on-card via the PIV GENERAL AUTHENTICATE command.

Re-exports

pub use context::parse_ec_public_key_from_cert_der;

pub use context::Context;

pub use context::ContextOptions;

pub use context::DevicePicker;

pub use context::KeySource;

pub use context::OutputOptions;

pub use context::PrintedRepair;

pub use context::Repairs;

pub use context::SlotKeyCheck;

pub use nvm::scan_nvm;

pub use nvm::NvmUsage;

pub use orchestrator::chunks_needed;

pub use orchestrator::collect_blob_chain;

pub use orchestrator::fetch_blob;

pub use orchestrator::list_blobs;

pub use orchestrator::objects_needed;

pub use orchestrator::remove_blob;

pub use orchestrator::remove_blobs;

pub use orchestrator::store_blob;

pub use orchestrator::BlobInfo;

pub use orchestrator::Compression;

pub use orchestrator::Encryption;

pub use orchestrator::StoreOptions;

pub use piv::hardware::HardwarePiv;

pub use piv::fixture_path;

pub use piv::open_backend;

pub use piv::DeviceInfo;

pub use piv::FlashHandle;

pub use piv::MgmtAlgo;

pub use piv::PinRef;

pub use piv::PivBackend;

pub use policy::SecretOp;

Modules

auxiliaries

Auxiliary helpers: TLV parsing, default-credential checks, PIN-protected management-key retrieval.

context

Runtime context shared across all CLI commands.

crypto

Hybrid encryption/decryption (ECDH + HKDF + AES-256-GCM).

errors

Typed errors and their human-readable rendering (spec 0025).

nvm

NVM free-space measurement.

orchestrator

High-level blob operations: store, fetch, remove, list.

piv

PIV backend trait and implementations.

policy

Default-credential policy (spec 0024): what each command does when some credentials are still at their factory values.

report

Read-only report on the state of a YubiKey (spec 0023 §1), shared by yb fsck and the guided yb format.

store

Binary store: serialization / deserialization of PIV objects.

Structs

Zeroizing

Secrets (management key, PIN) are held in Zeroizing buffers. Zeroizing is a a wrapper for any Z: Zeroize type which implements a Drop handler which zeroizes dropped values.