diff --git a/README.md b/README.md index 31515e2..702ff25 100644 --- a/README.md +++ b/README.md @@ -10,35 +10,71 @@ Built mostly on top of Yubico's Python APIs and the Cryptography library. ## Highlights -- Centralized configuration in a single YAML file - - Automatic key/cert generation based on the config file - - Sensible default config with comments -- Authenticate HSM operators by YubiKey 5 hardware tokens - - Integrated Yubikey HSM auth (yubihsm-auth) slot management for operators -- Integrate daily operations under a single tool: - - OpenSSH certificate creation and signing, including hardware token **sk-ed25519** and **sk-ecdsa** keys - - X.509 certificate creationg and signing - - Sanity checks / lint for generated certificates by usage - - TLS server cert creation - - PIV cert generation (Windows login with YubiKey) - - Store in YubiKey or save to disk - - Codesigning (Authenticode) for Windows executables (you'll need *osslsigncode* also) - - Password derivation for VMs etc. -- HSM audit logging - - Specify HSM audit policy in config file - - Incrementally fetch and parse log entries from YubiHSM - - from multiple devices (for HA / load balancing) - - store into SQlite database - - convenient "forced logging mode" support (with `log fetch --clear`) - - Show log entries in human-readable - - Verify audit chain integrity - - Export new logs to JSONL, for log server submission -- Improved Secret Sharing ceremony vs. YubiHSM setup util (vs. yubihsm-setup) - - password protected shares (optional) - - better display hygiene - - detailed interactive guiding -- Discourage leaking secrets in process listing, local disk or terminal scrollback - - Fully within one process, does not invoke external CLI tools (except in unit tests) + + + + + + + + + + + + + + + + + + + + + + + +
Define HSM with config file +
    +
  • Single YML file to configure keys, certs and users
    • +
  • Automatic key/cert generation based on the config file
    • +
  • Sensible default config with comments
    • +
+
High level service tools +
    +
  • TLS server cert creation
    • +
  • PIV / Smartcard cert generation (Windows login with YubiKey)
    • +
  • Codesigning (Authenticode) for Windows executables (you'll need osslsigncode also)
    • +
  • OpenSSH certificate creation and signing, including hardware token sk-ed25519 and sk-ecdsa keys
    • +
  • Generic X.509 certificate creation and signing
    • +
  • Stateless password derivation for VMs etc.
    • +
  • Sanity checks / lint for generated certificates by usage
    • +
+
Improved security +
    +
  • Authenticate all daily HSM ops by YubiKey 5 hardware tokens
    • +
  • Integrated Yubikey (HSMauth slot) management
    • +
  • When service accounts keys are needed, use ENV for passwords instead of CLI args
    • +
  • Fully within one process, does not invoke external CLI tools (except in unit tests)
    • +
  • Avoid leaking secrets in process listings, disk, or terminal scrollback
    • +
+
HSM audit logging +
    +
  • Specify HSM audit policy in config file
    • +
  • Incrementally fetch and parse log entries from YubiHSM
    • +
  • Store into SQlite database
    • +
  • Convenient "forced logging mode" support (with log fetch --clear)
    • +
  • Show log entries in human-readable format
    • +
  • Verify audit chain integrity
    • +
  • Export new logs to JSONL, for log server submission
    • +
  • Supports multiple devices (for HA / load balancing)
    • +
+
Improved Secret Sharing (SSSS) vs. yubihsm-setup +
    +
  • Password protected shares (optional)
    • +
  • Better display hygiene
    • +
  • Detailed interactive guiding
    • +
+
## Practical Examples