Adds support for YubiHSM Auth

This adds support for the YubiHSM Auth protocol as described in
https://docs.yubico.com/yesdk/users-manual/application-yubihsm-auth/interacting-yubihsm-2.html

This protocol ensure the derivation password for the authentication keys are kept
in secure devices.

.github/workflows/ci.yml

@@ -11,15 +11,22 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
     strategy:
       matrix:
-        platform:
-          - ubuntu-latest
-          - macos-latest
-        toolchain:
-          - stable
-          - 1.67.0 # MSRV
+        include:
+          - platform: ubuntu-latest
+            toolchain: stable
+            deps: sudo apt-get install libpcsclite-dev
+          - platform: macos-latest
+            toolchain: stable
+            deps: true
+          - platform: ubuntu-latest
+            toolchain: 1.67.0 # MSRV
+            deps: sudo apt-get install libpcsclite-dev
+          - platform: macos-latest
+            toolchain: 1.67.0 # MSRV
+            deps: true
+    runs-on: ${{ matrix.platform }}
     steps:
       - uses: actions/checkout@v1
       - name: cache .cargo/registry
@@ -41,14 +48,15 @@ jobs:
         with:
           toolchain: ${{ matrix.toolchain }}
           override: true
+      - run: ${{ matrix.deps }}
       - run: cargo build --release
       - run: cargo build --release --no-default-features
       - run: cargo build --release --no-default-features --features=passwords
       - run: cargo build --release --features=usb
+      - run: cargo build --release --features=yubihsm-auth
       - run: cargo build --benches
 
   test:
-    runs-on: ubuntu-latest
     strategy:
       matrix:
         platform:
@@ -57,6 +65,7 @@ jobs:
         toolchain:
           - stable
           - 1.67.0 # MSRV
+    runs-on: ${{ matrix.platform }}
     steps:
       - uses: actions/checkout@v1
       - name: cache .cargo/registry
@@ -103,6 +112,7 @@ jobs:
           toolchain: 1.71.0 # pinned to prevent CI breakages
           components: clippy
           override: true
+      - run: sudo apt-get install libpcsclite-dev
       - uses: actions-rs/cargo@v1
         with:
           command: clippy

Cargo.toml

@@ -49,6 +49,7 @@ pbkdf2 = { version = "0.12", optional = true, default-features = false, features
 serde_json = { version = "1", optional = true }
 rusb = { version = "0.9", optional = true }
 tiny_http = { version = "0.12", optional = true }
+yubikey = { git = "https://github.com/baloo/yubikey.rs", branch = "baloo/yubihsm-auth", optional = true }
 
 [dev-dependencies]
 ed25519-dalek = "2"
@@ -66,6 +67,7 @@ secp256k1 = ["k256"]
 setup = ["passwords", "serde_json", "uuid/serde"]
 untested = []
 usb = ["rusb"]
+yubihsm-auth = ["yubikey"]
 
 [package.metadata.docs.rs]
 all-features = true

src/client.rs

@@ -43,6 +43,9 @@ use std::{
 #[cfg(feature = "passwords")]
 use std::{thread, time::SystemTime};
 
+#[cfg(feature = "yubihsm-auth")]
+use crate::session::PendingSession;
+
 #[cfg(feature = "untested")]
 use {
     crate::{
@@ -106,6 +109,20 @@ impl Client {
         Ok(client)
     }
 
+    /// Open session with YubiHSM Auth scheme
+    #[cfg(feature = "yubihsm-auth")]
+    pub fn yubihsm_auth(
+        connector: Connector,
+        authentication_key_id: object::Id,
+        host_challenge: session::securechannel::Challenge,
+    ) -> Result<PendingSession, Error> {
+        let timeout = session::Timeout::default();
+
+        let session =
+            PendingSession::new(connector, timeout, authentication_key_id, host_challenge)?;
+        Ok(session)
+    }
+
     /// Borrow this client's YubiHSM connector (which is `Clone`able)
     pub fn connector(&self) -> &Connector {
         &self.connector
@@ -1165,3 +1182,15 @@ impl Client {
             .0)
     }
 }
+
+impl From<Session> for Client {
+    fn from(session: Session) -> Self {
+        let connector = session.connector();
+        let session = Arc::new(Mutex::new(Some(session)));
+        Self {
+            connector,
+            session,
+            credentials: None,
+        }
+    }
+}