lib: Add post-quantum cryptography support

This adds initial support for runtime-configurable encryption and
post-quantum Key Encapsulation Mechanisms (KEMs) and authentication
(ML-DSA).

Supported key exchange algorithms:

  ECDH: prime256v1, secp384r1, secp521r1, X25519, X448
  Finite Field DH: ffdhe2048, ffdhe3072, ffdhe4096
  ML-KEM (FIPS 203): ML-KEM-512, ML-KEM-768, ML-KEM-1024
  Hybrid KEMs: X25519MLKEM768, X448MLKEM1024

Supported ciphers:
  AEAD: aes-128-gcm, aes-192-gcm, aes-256-gcm, chacha20-poly1305
  CTR: aes-128-ctr, aes-192-ctr, aes-256-ctr

Supported HKDFs:
  sha256, sha384, sha512, sha3-256, sha3-384, sha3-512,
  blake2b512, blake2s256

Supported Digests for DSA:
  sha256, sha384, sha512, sha3-256, sha3-384, sha3-512,
  blake2b512, blake2s256

PQC support requires OpenSSL 3.4.0+ and is detected automatically via
CMake. A DISABLE_PQC option allows building without PQC even when
available.

KEMs differ from traditional DH in that they require asymmetric roles:
one party encapsulates to the other's public key. This creates a
coordination problem during simultaneous reconnection attempts. The
kem_mode configuration parameter resolves this by pre-assigning roles:

  kem_mode=server  # Server encapsulates (1-RTT, full forward secrecy)
  kem_mode=client  # Client encapsulates (0-RTT, cached server key)

The enc.conf file format supports:

  kex=<algorithm>      # Key exchange algorithm
  cipher=<algorithm>   # Symmetric cipher
  kdf=<KDF>            # Key derivation function
  digest=<digest>      # Digest for DSA
  kem_mode=<mode>      # Server (default) or client
  none                 # Disable encryption

The OAP protocol is extended to negotiate algorithms and exchange KEX
data. All KEX messages are signed using existing authentication
infrastructure for integrity and replay protection.

Tests are split into base and _pqc variants to handle conditional PQC
compilation (kex_test.c/kex_test_pqc.c, oap_test.c/oap_test_pqc.c).

Bumped minimum required OpenSSL version for encryption to 3.0
(required for HKDF API). 1.1.1 is long time EOL.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 457 insertions, 0 deletions

diff --git a/src/irmd/oap/tests/common.c b/src/irmd/oap/tests/common.c
new file mode 100644
index 00000000..0a1af100
--- /dev/null
+++ b/src/irmd/oap/tests/common.c
@@ -0,0 +1,457 @@
+/*
+ * Ouroboros - Copyright (C) 2016 - 2026
+ *
+ * Common test helper functions for OAP tests
+ *
+ *    Dimitri Staessens <dimitri@ouroboros.rocks>
+ *    Sander Vrijders   <sander@ouroboros.rocks>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., http://www.fsf.org/about/contact/.
+ */
+
+#include "common.h"
+
+#include <ouroboros/crypt.h>
+
+#include "oap.h"
+
+#include <string.h>
+#include <stdio.h>
+
+int load_srv_kex_config(const struct name_info * info,
+                        struct sec_config *      cfg)
+{
+        (void) info;
+
+        memset(cfg, 0, sizeof(*cfg));
+
+        if (test_cfg.srv.kex == NID_undef)
+                return 0;
+
+        SET_KEX_ALGO_NID(cfg, test_cfg.srv.kex);
+        SET_KEX_CIPHER_NID(cfg, test_cfg.srv.cipher);
+        SET_KEX_KDF_NID(cfg, test_cfg.srv.kdf);
+        SET_KEX_DIGEST_NID(cfg, test_cfg.srv.md);
+        SET_KEX_KEM_MODE(cfg, test_cfg.srv.kem_mode);
+
+        return 0;
+}
+
+int load_cli_kex_config(const struct name_info * info,
+                        struct sec_config *      cfg)
+{
+        (void) info;
+
+        memset(cfg, 0, sizeof(*cfg));
+
+        if (test_cfg.cli.kex == NID_undef)
+                return 0;
+
+        SET_KEX_ALGO_NID(cfg, test_cfg.cli.kex);
+        SET_KEX_CIPHER_NID(cfg, test_cfg.cli.cipher);
+        SET_KEX_KDF_NID(cfg, test_cfg.cli.kdf);
+        SET_KEX_DIGEST_NID(cfg, test_cfg.cli.md);
+        SET_KEX_KEM_MODE(cfg, test_cfg.cli.kem_mode);
+
+        return 0;
+}
+
+int load_srv_credentials(const struct name_info * info,
+                         void **                  pkp,
+                         void **                  crt)
+{
+        (void) info;
+
+        *pkp = NULL;
+        *crt = NULL;
+
+        if (!test_cfg.srv.auth)
+                return 0;
+
+        return mock_load_credentials(pkp, crt);
+}
+
+int load_cli_credentials(const struct name_info * info,
+                         void **                  pkp,
+                         void **                  crt)
+{
+        (void) info;
+
+        *pkp = NULL;
+        *crt = NULL;
+
+        if (!test_cfg.cli.auth)
+                return 0;
+
+        return mock_load_credentials(pkp, crt);
+}
+
+int oap_test_setup(struct oap_test_ctx * ctx,
+                   const char *          root_ca_str,
+                   const char *          im_ca_str)
+{
+        memset(ctx, 0, sizeof(*ctx));
+
+        strcpy(ctx->srv.info.name, "test-1.unittest.o7s");
+        strcpy(ctx->cli.info.name, "test-1.unittest.o7s");
+
+        if (oap_auth_init() < 0) {
+                printf("Failed to init OAP.\n");
+                goto fail_init;
+        }
+
+        if (crypt_load_crt_str(root_ca_str, &ctx->root_ca) < 0) {
+                printf("Failed to load root CA cert.\n");
+                goto fail_root_ca;
+        }
+
+        if (crypt_load_crt_str(im_ca_str, &ctx->im_ca) < 0) {
+                printf("Failed to load intermediate CA cert.\n");
+                goto fail_im_ca;
+        }
+
+        if (oap_auth_add_ca_crt(ctx->root_ca) < 0) {
+                printf("Failed to add root CA cert to store.\n");
+                goto fail_add_ca;
+        }
+
+        if (oap_auth_add_ca_crt(ctx->im_ca) < 0) {
+                printf("Failed to add intermediate CA cert to store.\n");
+                goto fail_add_ca;
+        }
+
+        return 0;
+
+ fail_add_ca:
+        crypt_free_crt(ctx->im_ca);
+ fail_im_ca:
+        crypt_free_crt(ctx->root_ca);
+ fail_root_ca:
+        oap_auth_fini();
+ fail_init:
+        memset(ctx, 0, sizeof(*ctx));
+        return -1;
+}
+
+void oap_test_teardown(struct oap_test_ctx * ctx)
+{
+        struct crypt_sk res;
+        buffer_t        dummy = BUF_INIT;
+
+        if (ctx->cli.state != NULL) {
+                res.key = ctx->cli.key;
+                oap_cli_complete(ctx->cli.state, &ctx->cli.info, dummy,
+                                 &ctx->data, &res);
+                ctx->cli.state = NULL;
+        }
+
+        freebuf(ctx->data);
+        freebuf(ctx->resp_hdr);
+        freebuf(ctx->req_hdr);
+
+        crypt_free_crt(ctx->im_ca);
+        crypt_free_crt(ctx->root_ca);
+
+        oap_auth_fini();
+        memset(ctx, 0, sizeof(*ctx));
+}
+
+int oap_cli_prepare_ctx(struct oap_test_ctx * ctx)
+{
+        return oap_cli_prepare(&ctx->cli.state, &ctx->cli.info, &ctx->req_hdr,
+                               ctx->data);
+}
+
+int oap_srv_process_ctx(struct oap_test_ctx * ctx)
+{
+        struct crypt_sk res = { .nid = NID_undef, .key = ctx->srv.key };
+        int            ret;
+
+        ret = oap_srv_process(&ctx->srv.info, ctx->req_hdr,
+                              &ctx->resp_hdr, &ctx->data, &res);
+        if (ret == 0)
+                ctx->srv.nid = res.nid;
+
+        return ret;
+}
+
+int oap_cli_complete_ctx(struct oap_test_ctx * ctx)
+{
+        struct crypt_sk res = { .nid = NID_undef, .key = ctx->cli.key };
+        int            ret;
+
+        ret = oap_cli_complete(ctx->cli.state, &ctx->cli.info, ctx->resp_hdr,
+                               &ctx->data, &res);
+        ctx->cli.state = NULL;
+
+        if (ret == 0)
+                ctx->cli.nid = res.nid;
+
+        return ret;
+}
+
+int roundtrip_auth_only(const char * root_ca,
+                        const char * im_ca_str)
+{
+        struct oap_test_ctx ctx;
+
+        TEST_START();
+
+        if (oap_test_setup(&ctx, root_ca, im_ca_str) < 0)
+                goto fail;
+
+        if (oap_cli_prepare_ctx(&ctx) < 0) {
+                printf("Client prepare failed.\n");
+                goto fail_cleanup;
+        }
+
+        if (oap_srv_process_ctx(&ctx) < 0) {
+                printf("Server process failed.\n");
+                goto fail_cleanup;
+        }
+
+        if (oap_cli_complete_ctx(&ctx) < 0) {
+                printf("Client complete failed.\n");
+                goto fail_cleanup;
+        }
+
+        if (ctx.cli.nid != NID_undef || ctx.srv.nid != NID_undef) {
+                printf("Cipher should not be set for auth-only.\n");
+                goto fail_cleanup;
+        }
+
+        oap_test_teardown(&ctx);
+
+        TEST_SUCCESS();
+        return TEST_RC_SUCCESS;
+
+ fail_cleanup:
+        oap_test_teardown(&ctx);
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}
+
+int roundtrip_kex_only(void)
+{
+        struct name_info cli_info;
+        struct name_info srv_info;
+        struct crypt_sk   res;
+        uint8_t          cli_key[SYMMKEYSZ];
+        uint8_t          srv_key[SYMMKEYSZ];
+        int              cli_nid;
+        int              srv_nid;
+        buffer_t         req_hdr   = BUF_INIT;
+        buffer_t         resp_hdr  = BUF_INIT;
+        buffer_t         data      = BUF_INIT;
+        void *           cli_state = NULL;
+
+        TEST_START();
+
+        memset(&cli_info, 0, sizeof(cli_info));
+        memset(&srv_info, 0, sizeof(srv_info));
+
+        strcpy(cli_info.name, "test-1.unittest.o7s");
+        strcpy(srv_info.name, "test-1.unittest.o7s");
+
+        if (oap_auth_init() < 0) {
+                printf("Failed to init OAP.\n");
+                goto fail;
+        }
+
+        if (oap_cli_prepare(&cli_state, &cli_info, &req_hdr,
+                            data) < 0) {
+                printf("Client prepare failed.\n");
+                goto fail_cleanup;
+        }
+
+        res.key = srv_key;
+
+        if (oap_srv_process(&srv_info, req_hdr, &resp_hdr, &data, &res) < 0) {
+                printf("Server process failed.\n");
+                goto fail_cleanup;
+        }
+
+        srv_nid = res.nid;
+
+        res.key = cli_key;
+
+        if (oap_cli_complete(cli_state, &cli_info, resp_hdr, &data, &res) < 0) {
+                printf("Client complete failed.\n");
+                cli_state = NULL;
+                goto fail_cleanup;
+        }
+
+        cli_nid = res.nid;
+        cli_state = NULL;
+
+        if (memcmp(cli_key, srv_key, SYMMKEYSZ) != 0) {
+                printf("Client and server keys do not match!\n");
+                goto fail_cleanup;
+        }
+
+        if (cli_nid == NID_undef || srv_nid == NID_undef) {
+                printf("Cipher should be set for kex-only.\n");
+                goto fail_cleanup;
+        }
+
+        freebuf(resp_hdr);
+        freebuf(req_hdr);
+        oap_auth_fini();
+
+        TEST_SUCCESS();
+        return TEST_RC_SUCCESS;
+
+ fail_cleanup:
+        if (cli_state != NULL) {
+                res.key = cli_key;
+                oap_cli_complete(cli_state, &cli_info, resp_hdr, &data, &res);
+        }
+        freebuf(resp_hdr);
+        freebuf(req_hdr);
+        oap_auth_fini();
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}
+
+int corrupted_request(const char * root_ca,
+                      const char * im_ca_str)
+{
+        struct oap_test_ctx ctx;
+
+        TEST_START();
+
+        if (oap_test_setup(&ctx, root_ca, im_ca_str) < 0)
+                goto fail;
+
+        if (oap_cli_prepare_ctx(&ctx) < 0) {
+                printf("Client prepare failed.\n");
+                goto fail_cleanup;
+        }
+
+        /* Corrupt the request */
+        if (ctx.req_hdr.len > 100) {
+                ctx.req_hdr.data[50] ^= 0xFF;
+                ctx.req_hdr.data[51] ^= 0xAA;
+                ctx.req_hdr.data[52] ^= 0x55;
+        }
+
+        if (oap_srv_process_ctx(&ctx) == 0) {
+                printf("Server should reject corrupted request.\n");
+                goto fail_cleanup;
+        }
+
+        oap_test_teardown(&ctx);
+
+        TEST_SUCCESS();
+        return TEST_RC_SUCCESS;
+
+ fail_cleanup:
+        oap_test_teardown(&ctx);
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}
+
+int corrupted_response(const char * root_ca,
+                       const char * im_ca_str)
+{
+        struct oap_test_ctx ctx;
+        struct crypt_sk      res;
+
+        TEST_START();
+
+        if (oap_test_setup(&ctx, root_ca, im_ca_str) < 0)
+                goto fail;
+
+        if (oap_cli_prepare_ctx(&ctx) < 0) {
+                printf("Client prepare failed.\n");
+                goto fail_cleanup;
+        }
+
+        if (oap_srv_process_ctx(&ctx) < 0) {
+                printf("Server process failed.\n");
+                goto fail_cleanup;
+        }
+
+        /* Corrupt the response */
+        if (ctx.resp_hdr.len > 100) {
+                ctx.resp_hdr.data[50] ^= 0xFF;
+                ctx.resp_hdr.data[51] ^= 0xAA;
+                ctx.resp_hdr.data[52] ^= 0x55;
+        }
+
+        res.key = ctx.cli.key;
+
+        if (oap_cli_complete(ctx.cli.state, &ctx.cli.info, ctx.resp_hdr,
+                             &ctx.data, &res) == 0) {
+                printf("Client should reject corrupted response.\n");
+                ctx.cli.state = NULL;
+                goto fail_cleanup;
+        }
+
+        ctx.cli.state = NULL;
+
+        oap_test_teardown(&ctx);
+
+        TEST_SUCCESS();
+        return TEST_RC_SUCCESS;
+
+ fail_cleanup:
+        oap_test_teardown(&ctx);
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}
+
+int truncated_request(const char * root_ca,
+                      const char * im_ca_str)
+{
+        struct oap_test_ctx ctx;
+        size_t              orig_len;
+
+        TEST_START();
+
+        if (oap_test_setup(&ctx, root_ca, im_ca_str) < 0)
+                goto fail;
+
+        if (oap_cli_prepare_ctx(&ctx) < 0) {
+                printf("Client prepare failed.\n");
+                goto fail_cleanup;
+        }
+
+        /* Truncate the request buffer */
+        orig_len = ctx.req_hdr.len;
+        ctx.req_hdr.len = orig_len / 2;
+
+        if (oap_srv_process_ctx(&ctx) == 0) {
+                printf("Server should reject truncated request.\n");
+                ctx.req_hdr.len = orig_len;
+                goto fail_cleanup;
+        }
+
+        ctx.req_hdr.len = orig_len;
+
+        oap_test_teardown(&ctx);
+
+        TEST_SUCCESS();
+        return TEST_RC_SUCCESS;
+
+ fail_cleanup:
+        oap_test_teardown(&ctx);
+ fail:
+        TEST_FAIL();
+        return TEST_RC_FAIL;
+}