irmd: Harden OAP handshake and add cert-less re-key

Adds support for:

Server key confirmation: the session key is bound to the
negotiated algorithm via the HKDF info. The server returns a
key-confirmation tag (rsp_tag, replacing the bare request-hash echo),
so a cipher downgrade or key desync is detected. The cleartext path
keeps a request echo, compared in constant time.

Sealed server identity: AEAD-seal the certificate, signature and
piggybacked data in the encrypted response (kex and rsp_tag move
ahead as AAD), hiding the server identity and response sizes.

Cert-less re-key: let the client omit its certificate, verifying the
peer against the cached certificate. On PQC flows, ephemeral
server-encap KEX (preserving forward secrecy) is used, even if the
original flow allocation was client-encap.

Signed-off-by: Dimitri Staessens <dimitri@ouroboros.rocks>
Signed-off-by: Sander Vrijders <sander@ouroboros.rocks>

1 files changed, 22 insertions, 0 deletions

diff --git a/src/irmd/oap/tests/oap_test_ml_dsa.c b/src/irmd/oap/tests/oap_test_ml_dsa.c
index 19be7400..8691aa00 100644
--- a/src/irmd/oap/tests/oap_test_ml_dsa.c
+++ b/src/irmd/oap/tests/oap_test_ml_dsa.c
@@ -179,6 +179,7 @@ int load_server_kem_pk(const char *        name,
         pk->data = malloc(test_kem_pk_len);
         if (pk->data == NULL)
                 return -1;
+
         memcpy(pk->data, test_kem_pk, test_kem_pk_len);
         pk->len = test_kem_pk_len;
 
@@ -254,6 +255,22 @@ static int test_oap_srv_md_pin_exempts_pqc(void)
         return roundtrip_auth_only(root_ca_crt_ml, im_ca_crt_ml);
 }
 
+static int test_oap_rekey(void)
+{
+        test_cfg_init(NID_X25519, NID_aes_256_gcm, NID_sha256,
+                      0, NO_CLI_AUTH);
+
+        return roundtrip_rekey(root_ca_crt_ml, im_ca_crt_ml);
+}
+
+static int test_oap_rekey_badcache(void)
+{
+        test_cfg_init(NID_X25519, NID_aes_256_gcm, NID_sha256,
+                      0, NO_CLI_AUTH);
+
+        return roundtrip_rekey_badcache(root_ca_crt_ml, im_ca_crt_ml);
+}
+
 static int test_oap_corrupted_request(void)
 {
         test_cfg_init(NID_MLKEM768, NID_aes_256_gcm, get_random_kdf(),
@@ -449,10 +466,15 @@ int oap_test_ml_dsa(int    argc,
         ret |= test_oap_corrupted_request();
         ret |= test_oap_corrupted_response();
         ret |= test_oap_truncated_request();
+
+        ret |= test_oap_rekey();
+        ret |= test_oap_rekey_badcache();
 #else
         (void) test_oap_roundtrip_auth_only;
         (void) test_oap_cli_md_pin_exempts_pqc;
         (void) test_oap_srv_md_pin_exempts_pqc;
+        (void) test_oap_rekey;
+        (void) test_oap_rekey_badcache;
         (void) test_oap_roundtrip_kem;
         (void) test_oap_roundtrip_kem_all;
         (void) test_oap_kem_srv_uncfg;