PIV is a NIST standard for both signing and encryption using SmartCards and SmartCard-based hardware tokens like YubiKeys.
This library natively implements the protocol used to manage and utilize PIV encryption and signing keys which can be generated, imported, and stored on YubiKey devices.
See Yubico's guide to PIV-enabled YubiKeys for more information on which devices support PIV and the available functionality.
NOTE: Nano and USB-C variants of the above are also supported
NOTE: RSASSA-PSS signatures and RSA-OAEP encryption may be supportable (TBD)
This is a work-in-progress effort, and while much of the library-level code from upstream yubico-piv-tool has been translated into Rust presenting a safe interface, much of it is still untested.
Please see the project's README.md for a complete status.
This library is a Rust translation of the yubico-piv-tool utility by Yubico, which was originally written in C. It was mechanically translated from C into Rust using Corrode, and then subsequently heavily refactored into safer, more idiomatic Rust.
No security audits of this crate have ever been performed. Presently it is in an experimental stage and may still contain high-severity issues.
USE AT YOUR OWN RISK!
We abide by the Contributor Covenant and ask that you do as well.
For more information, please see CODE_OF_CONDUCT.md.
yubikey-piv.rs is a fork of and originally a mechanical translation from Yubico's yubico-piv-tool, a C library/CLI program. The original library was licensed under a 2-Clause BSD License, which this library inherits as a derived work.
Cardholder Capability Container (CCC) ID Support
Cardholder Unique Identifier (CHUID) Support
YubiKey Configuration Values
MS Container Map Records
PIV cryptographic keys stored in a YubiKey.
Management Key (MGM) for authenticating to the YubiKey management applet
Support for enumerating available readers
Configuration setting values parsed from the environment and config file:
YubiKey-related types and communication support