#ssh #yubikey #certs #certificates

sshcerts

A library for parsing, verifying, and creating SSH Certificates

14 releases

new 0.4.4 May 1, 2021
0.4.3 Apr 24, 2021
0.3.14 Mar 18, 2021
0.3.13 Feb 19, 2021

#36 in Authentication

Download history 101/week @ 2021-02-06 60/week @ 2021-02-13 42/week @ 2021-02-20 34/week @ 2021-02-27 29/week @ 2021-03-06 26/week @ 2021-03-13 26/week @ 2021-03-20 35/week @ 2021-03-27 82/week @ 2021-04-03 35/week @ 2021-04-10 57/week @ 2021-04-17 32/week @ 2021-04-24 45/week @ 2021-05-01

186 downloads per month

Custom license

94KB
1.5K SLoC

sshcerts

sshcerts (formerly rustica-keys) is a library for parsing, creating, and signing OpenSSH certificates. It was originally based on rust-sshkeys by @dnaeon but has been significantly expanded to offer a greater writer API, certificate signature validation, issuing new certificates, and more.

This library contains other optional functionality for Yubikey key management. The Yubikey management module can be used to provision slot with keys that can never leave the device and SSH module for SSH signatures backed by a Yubikey. To enable this functionality use the feature yubikey.

Builds

macOS and Ubuntu Builds

API Stability

The API for this crate should not be considered stable and expect breaking changes between versions.

Security Warning

No review has been done. I built it because I thought people could find it useful. Be wary about using this in production without doing a thorough code review.

Yubikey Benchmarks

Yubikeys are not fast HSMs so running infra generating many certificates per second is going to be a challenge. I have benchmarked several kinds with both 256 and 384 bit ECDSA keys. The results are below:

ECDSA256 ECDSA384 Notes
4C FIPS <4.4.5> - - Requires pin on sign
Nano 4C <4.3.7> 9.14 6.35
Nano 5C <5.2.4> 10.58 7.10
5 NFC <5.2.7> 10.93 7.20
5Ci <5.2.4> 10.94 7.22

This shows 5s are about 15% faster than 4s but between 5s is mostly a wash. Loading the same key on multiple Yubikeys would provide a multiplicative speed up (equal to number of keys) but if you need that many signatures per second, Yubikeys are probably not the way to go.

Licence

This software is provided under the MIT licence so you may use it basically however you wish so long as all distributions and derivatives (source and binary) include the copyright from the LICENSE.

Dependencies

~4.5–7.5MB
~207K SLoC