Skip to content

Releases: obelisk/sshcerts

Fewer Dependencies

07 Feb 08:26
Compare
Choose a tag to compare

I have now removed sha2 (replaced with ring::digest)
Hex has been moved to a dev dependency.
ByteOrder has been removed and replaced with functions from the the standard library.

Examples and No More Clap

07 Feb 05:16
Compare
Choose a tag to compare

This is a pretty minor change but a big deal in terms of build times: removing the clap dependency.

Clap was only used in binaries so I converted them to examples and it's no longer included in a library build.

Private Keys and Provision Subjects

22 Jan 05:00
Compare
Choose a tag to compare

Two major things in this release:

Private Key Parsing

OpenSSH has its own proprietary format for storing SSH keys. Sometimes being able to parse these keys is useful (if you need to sign something with your SSH key for example). There is now a module that will do a best effort parsing of the file format. The format contains the entire public key as well so you get that for free as a field.

Setting The Subject in Provision

Generally provision is just used to create private keys but because of a quirk of the PCSC spec (I think) we can only retrieve the public key from a slot if there is a certificate loaded in it. Provision will create this certificate just to hold the public key for us to retrieve later but this has the effect of allowing us to store data in the Subject field. You can now specify this data and it is shown in they yk-fingerprint tool.

This is used in the Rustica project to let you easily label your keys as they may all have different roles and permissions.

p384 and Ed25519 Support

15 Jan 22:28
Compare
Choose a tag to compare

Full support for p384: The yubikey module has also been updated so that it will work correctly when you want to sign or create p384 data.

You can now validate certs which use nistp384 OR Ed25519 signatures. Yubikey functionality is not there however since their support for ed25519 is very new and I'm not sure if it's compatible yet. I would also need to make significant modifications to the yubikey_piv upstream library.