OxiSH: SSH server written in Rust

OxiSH is an SSH server written in Rust. It is currently a minimum viable product and not yet ready for production use. It is intended to be a secure, modern SSH server that supports post-quantum key exchange and FIPS-validated cryptography.

Features

Only support modern cryptography, including hybrid post-quantum key exchange
Support for FIPS-validated cryptography on Linux when compiled with aws-lc-fips crypto
Usable as server and library, including sans-I/O protocol implementation

If any features you need are missing, please open an issue or submit a pull request.

Limitations

Only supports Linux and macOS for now (looking for a Windows contributor)
Only supports public key authentication for now
No SFTP support yet
Requires clients with support for mlkem768x25519-sha256 key exchange (OpenSSH 9.9+)
No support for older cryptographic algorithms

References to RFCs consulted during development

RFC 4251: The Secure Shell (SSH) Protocol Architecture
RFC 4253: The Secure Shell (SSH) Transport Layer Protocol
RFC 4254: The Secure Shell (SSH) Connection Protocol
RFC 4344: The Secure Shell (SSH) Transport Layer Encryption Modes
RFC 5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol
RFC 5656: Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
RFC 6668: SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol
RFC 8709: Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol
RFC 8731: Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448
RFC 9142: Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH)