lib: Add post-quantum cryptography support

This adds initial support for runtime-configurable encryption and
post-quantum Key Encapsulation Mechanisms (KEMs) and authentication
(ML-DSA).

Supported key exchange algorithms:

  ECDH: prime256v1, secp384r1, secp521r1, X25519, X448
  Finite Field DH: ffdhe2048, ffdhe3072, ffdhe4096
  ML-KEM (FIPS 203): ML-KEM-512, ML-KEM-768, ML-KEM-1024
  Hybrid KEMs: X25519MLKEM768, X448MLKEM1024

Supported ciphers:
  AEAD: aes-128-gcm, aes-192-gcm, aes-256-gcm, chacha20-poly1305
  CTR: aes-128-ctr, aes-192-ctr, aes-256-ctr

Supported HKDFs:
  sha256, sha384, sha512, sha3-256, sha3-384, sha3-512,
  blake2b512, blake2s256

Supported Digests for DSA:
  sha256, sha384, sha512, sha3-256, sha3-384, sha3-512,
  blake2b512, blake2s256

PQC support requires OpenSSL 3.4.0+ and is detected automatically via
CMake. A DISABLE_PQC option allows building without PQC even when
available.

KEMs differ from traditional DH in that they require asymmetric roles:
one party encapsulates to the other's public key. This creates a
coordination problem during simultaneous reconnection attempts. The
kem_mode configuration parameter resolves this by pre-assigning roles:

  kem_mode=server  # Server encapsulates (1-RTT, full forward secrecy)
  kem_mode=client  # Client encapsulates (0-RTT, cached server key)

The enc.conf file format supports:

  kex=<algorithm>      # Key exchange algorithm
  cipher=<algorithm>   # Symmetric cipher
  kdf=<KDF>            # Key derivation function
  digest=<digest>      # Digest for DSA
  kem_mode=<mode>      # Server (default) or client
  none                 # Disable encryption

The OAP protocol is extended to negotiate algorithms and exchange KEX
data. All KEX messages are signed using existing authentication
infrastructure for integrity and replay protection.

Tests are split into base and _pqc variants to handle conditional PQC
compilation (kex_test.c/kex_test_pqc.c, oap_test.c/oap_test_pqc.c).

Bumped minimum required OpenSSL version for encryption to 3.0
(required for HKDF API). 1.1.1 is long time EOL.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 33 insertions, 60 deletions

diff --git a/src/irmd/oap.h b/src/irmd/oap.h
index ccdfa804..25c07408 100644
--- a/src/irmd/oap.h
+++ b/src/irmd/oap.h
@@ -1,7 +1,7 @@
 /*
  * Ouroboros - Copyright (C) 2016 - 2024
  *
- * Ouroboros flow allocation protocol header
+ * Ouroboros Allocation Protocol (OAP) Component
  *
  *    Dimitri Staessens <dimitri@ouroboros.rocks>
  *    Sander Vrijders   <sander@ouroboros.rocks>
@@ -23,72 +23,45 @@
 #ifndef OUROBOROS_IRMD_OAP_H
 #define OUROBOROS_IRMD_OAP_H
 
+#include <ouroboros/crypt.h>
+#include <ouroboros/flow.h>
+#include <ouroboros/name.h>
 #include <ouroboros/utils.h>
 
-#define OAP_ID_SIZE      (16)
-#define OAP_HDR_MIN_SIZE (OAP_ID_SIZE + sizeof(uint64_t) + 4 * sizeof(uint16_t))
+/* OAP authentication state (in oap/auth.c) */
+int  oap_auth_init(void);
 
+void oap_auth_fini(void);
 
-/*
- *  0                   1                   2                   3
- *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
- * +---------------------------------------------------------------+
- * |                                                               |
- * |                        id (128 bits)                          |
- * |                                                               |
- * |                                                               |
- * +---------------------------------------------------------------+
- * |                      timestamp (64 bits)                      |
- * |                                                               |
- * +---------------------------------------------------------------+
- * |      crt_len  (16 bits)     |                                 |
- * +-----------+-----------------+                                 |
- * |                        certificate                            |
- * |                                                               |
- * +---------------------------------------------------------------+
- * |      eph_len  (16 bits)     |                                 |
- * +-----------+-----------------+                                 |
- * |                   public key for ECDHE                        |
- * |                                                               |
- * +---------------------------------------------------------------+
- * |     data_len (16 bits)      |                                 |
- * +-----------+-----------------+                                 |
- * |               piggy backed application data                   |
- * |                                                               |
- * +---------------------------------------------------------------+
- * |     sig_len  (16 bits)      |                                 |
- * +-----------+-----------------+                                 |
- * |                         signature                             |
- * |                                                               |
- * +---------------------------------------------------------------+
- */
-
-struct oap_hdr {
-        uint64_t timestamp;
-        buffer_t id;
-        buffer_t crt;
-        buffer_t eph;
-        buffer_t data;
-        buffer_t sig;
-        buffer_t hdr;
-};
-
-int  oap_hdr_init(buffer_t         id,
-                  void *           pkp,
-                  void *           pubcrt,
-                  buffer_t         ephkey,
-                  buffer_t         data,
-                  struct oap_hdr * oap_hdr);
+int  oap_auth_add_ca_crt(void * crt);
 
-void oap_hdr_fini(struct oap_hdr * oap_hdr);
+/*
+* Prepare OAP request header for server, returns context
+* Passes client data for srv, returns srv data for client
+*/
+int  oap_cli_prepare(void **                  ctx,
+                     const struct name_info * info,
+                     buffer_t *               req_buf,
+                     buffer_t                 data);
 
-int  oap_hdr_decode(buffer_t         hdr,
-                    struct oap_hdr * oap_hdr);
+/*
+ * Server processes header, creates response header, returns secret key.
+ * data is in/out: input=srv data to send, output=cli data received.
+ */
+int  oap_srv_process(const struct name_info * info,
+                     buffer_t                 req_buf,
+                     buffer_t *               rsp_buf,
+                     buffer_t *               data,
+                     struct crypt_sk *        sk);
 
-#ifdef DEBUG_PROTO_OAP
-void debug_oap_hdr_snd(const struct oap_hdr * hdr);
+/* Complete OAP, returns secret key and server data, frees ctx */
+int  oap_cli_complete(void *                   ctx,
+                      const struct name_info * info,
+                      buffer_t                 rsp_buf,
+                      buffer_t *               data,
+                      struct crypt_sk *        sk);
 
-void debug_oap_hdr_rcv(const struct oap_hdr * hdr);
-#endif /* DEBUG_PROTO_OAP */
+/* Free OAP state (on failure before complete) */
+void oap_ctx_free(void * ctx);
 
 #endif /* OUROBOROS_IRMD_OAP_H */