Pure Rust implementation of components of the Secure Shell (SSH) protocol

Rust Crypto

Last update: Dec 27, 2022

Related tags

Cryptography SSH

Overview

RustCrypto: SSH

Pure Rust implementation of components of the Secure Shell (SSH) protocol.

Crates

Name	crates.io	Docs	Description
`ssh—encoding`			Decoders and encoders for SSH protocol data types
`ssh—key`			SSH key and certificate library with signing support

License

All crates licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

Comments

Support for SSH key signing

I tried implementing the new commit signing of Git with the git2 and ssh-key crate. This crate was a great help and contained almost all the pieces I needed to create working signatures.

Took me a few hours of searching around and fiddling with the signature format, but got a working implementation of the signing part. Definitely needs tons of tests and more verification, but it's a start.

The main part that is missing, is this SSH signature scheme: https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.sshsig

I was wondering if this is something that would make sense to include into ssh-key, or may it be out of scope? Would try to start integrating my current solution into the crate and open a PR, if there is interest.

opened by dnaka91 16
ssh-key: add partial support for U2F signatures verification
Hi,

I saw the recent release of v0.5 that added support for SSH signatures, and noticed that U2F/sk signatures were still missing.

I did some preliminary work to implement verification of ed25519-sk signatures. This is almost in a mergeable state, there's a few outstanding items and before doing too much I thought I'd check in with you.

Here's a short recap:

only verification is supported as signature generation would require interaction with hardware devices which is a lot more work;

only sk-ed25519 is currently implemented, p256 is TBD;

I made a few design choices about where to store the various components of the signature, I'm not super familiar with the project so if you have objections on how some of the things are implemented, I'm happy to change stuff around. Generally, feel free to change things yourself if you want. Mostly I tried to keep everything inside the Sshsig layer, but it could make sense to have a dedicated one for this format as those signature are a sort of wrapper around regular SSH signatures;

one of the tests (encoding the signature from raw bytes) currently fails. I am not entirely sure what is the best abstraction to hook into. The Signature decoding mechanism expects length-prefixed data, but sk signatures have 5 trailing bytes that are just added at the end. They are part of the signed data. Is there a good way to read those? Alternatively they could be removed from the test data given that they're not included in the length.

As mentioned before, I can (time permitting) incorporate comments that you may have, or I'm perfectly fine if you'd like to take it from here and hit this into shape.

Bye A.
opened by a-dma 7
build(deps): bump serde from 1.0.149 to 1.0.151
Bumps serde from 1.0.149 to 1.0.151.

Release notes

Sourced from serde's releases.

v1.0.151

Update serde::{ser,de}::StdError to re-export core::error::Error when serde is built with feature="std" off and feature="unstable" on (#2344)

v1.0.150

Relax some trait bounds from the Serialize impl of HashMap and BTreeMap (#2334)

Enable Serialize and Deserialize impls of std::sync::atomic types on more platforms (#2337, thanks @badboy)

Commits

44bf363 Release 1.0.151

f261184 Merge pull request #2344 from dtolnay/coreerror

df40f80 Make StdError identical to core::error::Error on feature="unstable"

e7060ba Merge pull request #2342 from atouchet/badges

d98f0ee Update build status badge

4f157a8 Prevent build.rs rerunning unnecessarily on all source changes

d493649 Release 1.0.150

0e947e6 Merge pull request #2338 from serde-rs/atomic

9249dab Deduplicate atomic_impl macro calls

7440e56 Deduplicate atomic_impl macro implementations

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
build(deps): bump serde from 1.0.149 to 1.0.150
Bumps serde from 1.0.149 to 1.0.150.

Release notes

Sourced from serde's releases.

v1.0.150

Relax some trait bounds from the Serialize impl of HashMap and BTreeMap (#2334)

Enable Serialize and Deserialize impls of std::sync::atomic types on more platforms (#2337, thanks @badboy)

Commits

d493649 Release 1.0.150

0e947e6 Merge pull request #2338 from serde-rs/atomic

9249dab Deduplicate atomic_impl macro calls

7440e56 Deduplicate atomic_impl macro implementations

0d79306 Update atomic_impl macros to have same input syntax in all cfgs

37faaf2 Mention target_has_atomic stabilization

650358f Replace obsolete comment about target_has_atomic support

6159ead Invert use_target_has_atomic cfg

692ac99 Format PR 2337 with rustfmt

86161ce Adjust spacing in some macro matchers

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
build(deps): bump serde from 1.0.147 to 1.0.148
Bumps serde from 1.0.147 to 1.0.148.

Release notes

Sourced from serde's releases.

v1.0.148

Support remote derive for generic types that have private fields (#2327)

Commits

7766103 Release 1.0.148

30f7c71 Merge pull request #2331 from dtolnay/remote

50354c2 Improve error message on remote derive duplicate generics

c4f67e6 Add ui test of duplicate generics in remote derive

0daafe4 Merge pull request #2330 from dtolnay/remote

3702191 Fix Into conversion involving generic remote derive with getter

7328b34 Add test of generic remote derive with getter

fabbd2b Merge pull request #2329 from dtolnay/safety

6814f97 Revert Buf::as_str safety change from PR 2319

4ea403c Merge pull request #2328 from dtolnay/remote

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
build(deps): bump rsa from 0.7.0 to 0.7.1
Bumps rsa from 0.7.0 to 0.7.1.

Changelog

Sourced from rsa's changelog.

0.7.1 (2022-10-31)

Added

Documentation improvements (#216)

Changed

Ensure PaddingScheme is Send and Sync (#215)

#215: RustCrypto/RSA#215 #216: RustCrypto/RSA#216

Commits

4f1d413 v0.7.1 (#218)

eeb18ee Add missing rustdoc comments; enable missing_docs lint (#216)

a857c8f padding: ensure PaddingScheme is Send and Sync (#215)

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
How to encrypt/verify custom data ?
Hello everyone!

Could someone tell me, how can I encrypt/verify my custom data via this lib ?

For example:

Client is sending a phone number to the server

Server is generating sms code and send it to the Client phone

Server is generating a token with combination user phone and sms code, and send it to the Client

Client is writing a form with a received sms code and send it to the server with phone number and token

Server is validating all received data and make a decision for login or not

Thanks!
opened by kosten 1
build(deps): bump ctr from 0.9.1 to 0.9.2
Bumps ctr from 0.9.1 to 0.9.2.

Commits

6532094 ctr: implement Clone directly instead of deriving it (#24)

37276dd ctr: add comment to doc example to clarify seek usage (#22)

b8967df Corrects a typo in a comment (#21)

7ba177e Remove html_root_url and update logo URL (#20)

d2085c7 cfb-mode: release v0.8.2 (#19)

29ab1c2 cfb-mode: add Buffer{Encryptor|Decryptor} (#17)

a1e06f2 pcbc: tweak code to help with codegen (#16)

5781d3f cbc: tweak code to help with codegen (#15)

de6bda9 Update Cargo.lock (#13)

8ffb6ba Cache cargo index (#12)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
build(deps): bump sec1 from 0.2.1 to 0.3.0
Bumps sec1 from 0.2.1 to 0.3.0.

Commits

0aeed43 pem-rfc7468 v0.3.0 (#217)

c28fdb7 const-oid v0.7.0 (#216)

5f78831 der: bump crypto-bigint dependency to v0.3 (#215)

3d1aaee pkcs8: rename Error::EncryptedKey => ::EncryptedPrivateKey (#214)

edb2c6a pkcs8: rename Error::Crypto => Error::EncryptedKey (#213)

128b7f4 spki: error improvements (#212)

78c58e9 pkcs8: don't re-export der::pem (#211)

3a54a0e pkcs8: re-export spki crate (#210)

1b30cbf der: bump crypto-bigint to v0.3.0-pre.1 (#209)

9e08b53 der_derive: add proc macro for deriving ValueOrd (#206)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
build(deps): bump p256 from 0.10.1 to 0.11.1
Bumps p256 from 0.10.1 to 0.11.1.

Commits

78ca5ef p256 v0.11.1 (#603)

0e86925 p256: use generic prime order formulas (#602)

fb44d75 p384: use generic prime order formulas (#601)

d3386b7 p256: criterion benchmarks (#597)

458112a p384: extract impl_field_invert! macro (#596)

afe6bf0 p256: move FieldElement inherent impl block to top of file (#595)

8d1ea51 p256+p384: documentation improvements (#594)

f3ae7d5 p256/p384: Update/add RFC 6979 test vectors (#591)

84e0edf p384 v0.11.0 (#593)

0dbf939 p384: use canonical form constants (#592)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 1
build(deps): bump serde from 1.0.149 to 1.0.152
Bumps serde from 1.0.149 to 1.0.152.

Release notes

Sourced from serde's releases.

v1.0.152

Documentation improvements

v1.0.151

Update serde::{ser,de}::StdError to re-export core::error::Error when serde is built with feature="std" off and feature="unstable" on (#2344)

v1.0.150

Relax some trait bounds from the Serialize impl of HashMap and BTreeMap (#2334)

Enable Serialize and Deserialize impls of std::sync::atomic types on more platforms (#2337, thanks @badboy)

Commits

ccf9c6f Release 1.0.152

b25d0ea Link to Hjson data format

4f4557f Link to bencode data format

bf400d6 Link to serde_tokenstream data format

4d2e36d Wrap flexbuffers bullet point to 80 columns

df6310e Merge pull request #2347 from dtolnay/docsrs

938ab5d Replace docs.serde.rs links with intra-rustdoc links

ef5a0de Point documentation links to docs.rs instead of docs.serde.rs

5d186c7 Opt out -Zrustdoc-scrape-examples on docs.rs

44bf363 Release 1.0.151

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependencies rust
opened by dependabot[bot] 0
Additional crates
This is a brainstorming issue for additional crates which could go in this repo.

[x] ssh-encoding

[x] ssh-key

[ ] Others?

There is no current plan to provide a full SSH protocol in this repo, and we are only looking to provide common functionality which is useful for multiple SSH implementations and use cases outside full SSH protocol implementations, such as interoperating with the SSH key/certificate formats and providing linkage to the respective RustCrypto signing algorithm implementations.

However, with sufficient interest that may change.
opened by tarcieri 6
ssh_key::Signature doesn't round-trip through Signature trait

Afaict the Signature::from_bytes method expects a algorithm type string as a prefix, but Signature::as_bytes doesn't return the algorithm type string as a prefix.

opened by programmerjake 2
Merging ssh-key and sshcerts

Heyo,

So I've been working on SSH Certificate parsing in pure rust for a while and might have some features that we could port over. I would also love to be able to get feedback on the code I've been writing for the past 2 years.

https://github.com/obelisk/sshcerts

Ultimately it would probably be best if we could port all the functionality for dealing with SSH certificates over then I can retire that crate and build more specific ones for the Yubikey portions.

opened by obelisk 5

Owner

Rust Crypto

Cryptographic algorithms written in pure Rust

GitHub

ssh-box: use ssh keys to encrypt files

ssh-box: use ssh keys to encrypt files work in progress ssh-box file format A file encrypted by ssh-box is an ASCII-armored binary file. The binary co

3 Jun 27, 2022

Use Touch ID / Secure Enclave for SSH Authentication!

SeKey About SeKey is a SSH Agent that allow users to authenticate to UNIX/Linux SSH servers using the Secure Enclave How it Works? The Secure Enclave

2.3k Jan 5, 2023

A safe implementation of the secure remote password authentication and key-exchange protocol (SRP), SRP6a and legacy are as features available.

Secure Remote Password (SRP 6 / 6a) A safe implementation of the secure remote password authentication and key-exchange protocol (SRP version 6a). Ver

10 Nov 3, 2022

Easy to use cryptographic framework for data protection: secure messaging with forward secrecy and secure data storage. Has unified APIs across 14 platforms.

Themis provides strong, usable cryptography for busy people General purpose cryptographic library for storage and messaging for iOS (Swift, Obj-C), An