OxiSH: SSH server written in Rust

OxiSH is an SSH server written in Rust. It is currently a minimum viable product and not yet ready for production use. It is intended to be a secure, modern SSH server that supports post-quantum key exchange and FIPS-validated cryptography.

Features

• Only support modern cryptography, including hybrid post-quantum key exchange
• Support for FIPS-validated cryptography on Linux when compiled with aws-lc-fips crypto
• Usable as server and library, including sans-I/O protocol implementation

If any features you need are missing, please open an issue or submit a pull request.

Limitations

• Only supports Linux and macOS for now (looking for a Windows contributor)
• Only supports public key authentication for now
• No SFTP support yet
• Requires clients with support for mlkem768x25519-sha256 key exchange (OpenSSH 9.9+)
• No support for older cryptographic algorithms

Supported cryptographic algorithms

• Key exchange:
  • mlkem768x25519-sha256
  • curve25519-sha256
• Public key:
  • ed25519
  • ecdsa-sha2-nistp256
• Encryption:
  • aes128-gcm@openssh.com

References to RFCs consulted during development

• RFC 4251: The Secure Shell (SSH) Protocol Architecture
• RFC 4253: The Secure Shell (SSH) Transport Layer Protocol
• RFC 4254: The Secure Shell (SSH) Connection Protocol
• RFC 4344: The Secure Shell (SSH) Transport Layer Encryption Modes
• RFC 5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol
• RFC 5656: Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
• RFC 6668: SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol
• RFC 8709: Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol
• RFC 8731: Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448
• RFC 9142: Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH)