← 返回日报
略读 预计 1 分钟

OxiSH: SSH server written in Rust

摘要

OxiSH 是一个用 Rust 编写的 SSH 服务器，目前为最小可用产品，尚不适合生产环境。它只支持现代加密，包括混合后量子密钥交换，在 Linux 上配合 aws-lc-fips 编译时可支持 FIPS 验证的加密。项目既可作服务器使用，也可作为库集成，包含 sans-I/O 协议实现。当前限制包括：仅支持 Linux 和 macOS、仅支持公钥认证、无 SFTP、要求客户端支持 mlkem768x25519-sha256 密钥交换（OpenSSH 9.9+），且不支持旧加密算法。文中还列出了开发过程中参考的多份 SSH 相关 RFC。

荐读理由

Rust 写的 SSH 服务端，支持混合后量子密钥交换，可作库嵌入你的项目；但仅公钥认证、无 SFTP，生产环境暂不可用

原文

OxiSH: SSH server written in Rust

Build status codecov License: MIT License: Apache 2.0 Chat

OxiSH is an SSH server written in Rust. It is currently a minimum viable product and not yet ready for production use. It is intended to be a secure, modern SSH server that supports post-quantum key exchange and FIPS-validated cryptography.

Features

  • Only support modern cryptography, including hybrid post-quantum key exchange

  • Support for FIPS-validated cryptography on Linux when compiled with aws-lc-fips crypto

  • Usable as server and library, including sans-I/O protocol implementation

If any features you need are missing, please open an issue or submit a pull request.

Limitations

  • Only supports Linux and macOS for now (looking for a Windows contributor)

  • Only supports public key authentication for now

  • No SFTP support yet

  • Requires clients with support for mlkem768x25519-sha256 key exchange (OpenSSH 9.9+)

  • No support for older cryptographic algorithms

References to RFCs consulted during development

  • RFC 4251: The Secure Shell (SSH) Protocol Architecture

  • RFC 4253: The Secure Shell (SSH) Transport Layer Protocol

  • RFC 4254: The Secure Shell (SSH) Connection Protocol

  • RFC 4344: The Secure Shell (SSH) Transport Layer Encryption Modes

  • RFC 5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol

  • RFC 5656: Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer

  • RFC 6668: SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol

  • RFC 8709: Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol

  • RFC 8731: Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448

  • RFC 9142: Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH)

Lobsters · 4 赞 · 0 评 讨论 → 阅读原文 →

这条对你有帮助吗？