Add post-quantum remote auth key exchange

browser_cli/auth.py

@@ -1,4 +1,4 @@
-"""Ed25519 keypair management and challenge-response auth helpers."""
+"""Ed25519 keypair management, ML-KEM key exchange, and auth helpers."""
 import hashlib
 import json
 import os
@@ -152,34 +152,75 @@ def public_key_hex(key: Ed25519PrivateKey | AgentKey) -> str:
 # ── Canonical payload + sign/verify ───────────────────────────────────────────
 
 def canonical_payload(msg: dict) -> bytes:
-    """Deterministic JSON encoding of msg without auth fields."""
+    """Deterministic JSON encoding of msg without auth protocol fields."""
     return json.dumps(
-        {k: v for k, v in msg.items() if k not in {"pubkey", "sig"}},
+        {k: v for k, v in msg.items() if k not in {"pubkey", "sig", "pq_kex"}},
         sort_keys=True,
         separators=(",", ":"),
     ).encode("utf-8")
 
 
-def sign(key: Ed25519PrivateKey | AgentKey, nonce: bytes, msg: dict) -> bytes:
-    """Sign nonce + SHA256(canonical_payload(msg)) — works for both file keys and agent keys."""
+def _auth_message(nonce: bytes, msg: dict, pq_shared_secret: bytes | None = None) -> bytes:
+    """Bytes signed for auth; optionally binds a post-quantum KEX secret."""
     data = nonce + hashlib.sha256(canonical_payload(msg)).digest()
+    if pq_shared_secret is not None:
+        data += hashlib.sha256(b"browser-cli ml-kem-768 v1" + pq_shared_secret).digest()
+    return data
+
+
+def sign(key: Ed25519PrivateKey | AgentKey, nonce: bytes, msg: dict, pq_shared_secret: bytes | None = None) -> bytes:
+    """Sign nonce + payload hash, optionally bound to an ML-KEM shared secret."""
+    data = _auth_message(nonce, msg, pq_shared_secret)
     if isinstance(key, AgentKey):
         return agent_sign_raw(key, data)
     return key.sign(data)
 
 
-def verify(pub_hex: str, nonce: bytes, msg: dict, sig_hex: str) -> bool:
-    """Return True if sig_hex is a valid Ed25519 signature over the canonical payload."""
+def verify(pub_hex: str, nonce: bytes, msg: dict, sig_hex: str, pq_shared_secret: bytes | None = None) -> bool:
+    """Return True if sig_hex is a valid signature over the canonical payload/auth secret."""
     try:
         pub_bytes = bytes.fromhex(pub_hex)
         pub_key = Ed25519PublicKey.from_public_bytes(pub_bytes)
-        message = nonce + hashlib.sha256(canonical_payload(msg)).digest()
-        pub_key.verify(bytes.fromhex(sig_hex), message)
+        pub_key.verify(bytes.fromhex(sig_hex), _auth_message(nonce, msg, pq_shared_secret))
         return True
     except (InvalidSignature, ValueError):
         return False
 
 
+# ── Post-quantum key exchange (ML-KEM / Kyber) ────────────────────────────────
+
+PQ_KEX_ALG = "ML-KEM-768"
+
+
+def pq_kex_server_keypair():
+    """Return an ephemeral ML-KEM-768 private key and raw public key bytes.
+
+    Returns ``None`` when the installed cryptography/OpenSSL backend does not
+    support ML-KEM yet. The serve/client protocol treats this as graceful
+    downgrade instead of breaking local installs on older OpenSSL builds.
+    """
+    try:
+        from cryptography.hazmat.primitives.asymmetric import mlkem
+        priv = mlkem.MLKEM768PrivateKey.generate()
+        pub = priv.public_key().public_bytes_raw()
+        return priv, pub
+    except Exception:
+        return None
+
+
+def pq_kex_client_encapsulate(public_key_hex: str) -> tuple[str, bytes]:
+    """Encapsulate to a server ML-KEM public key. Returns (ciphertext_hex, secret)."""
+    from cryptography.hazmat.primitives.asymmetric import mlkem
+    pub = mlkem.MLKEM768PublicKey.from_public_bytes(bytes.fromhex(public_key_hex))
+    ciphertext, shared_secret = pub.encapsulate()
+    return ciphertext.hex(), shared_secret
+
+
+def pq_kex_server_decapsulate(private_key, ciphertext_hex: str) -> bytes:
+    """Decapsulate a client ML-KEM ciphertext and return the shared secret."""
+    return private_key.decapsulate(bytes.fromhex(ciphertext_hex))
+
+
 def new_nonce() -> str:
     return secrets.token_hex(32)
 

browser_cli/client.py

@@ -319,10 +319,15 @@ def _send_remote(endpoint: str, msg: dict, private_key=None) -> bytes | None:
                 pass
 
         if nonce_hex and private_key is not None:
-            from browser_cli.auth import sign, public_key_hex
+            from browser_cli.auth import PQ_KEX_ALG, pq_kex_client_encapsulate, sign, public_key_hex
             nonce = bytes.fromhex(nonce_hex)
-            clean_msg = {k: v for k, v in msg.items() if k not in {"token", "pubkey", "sig"}}
-            sig = sign(private_key, nonce, clean_msg)
+            clean_msg = {k: v for k, v in msg.items() if k not in {"token", "pubkey", "sig", "pq_kex"}}
+            pq_shared_secret = None
+            kex = challenge.get("pq_kex") if isinstance(challenge, dict) else None
+            if isinstance(kex, dict) and kex.get("alg") == PQ_KEX_ALG and kex.get("public_key"):
+                ciphertext_hex, pq_shared_secret = pq_kex_client_encapsulate(str(kex["public_key"]))
+                clean_msg["pq_kex"] = {"alg": PQ_KEX_ALG, "ciphertext": ciphertext_hex}
+            sig = sign(private_key, nonce, clean_msg, pq_shared_secret)
             msg = {**clean_msg, "pubkey": public_key_hex(private_key), "sig": sig.hex()}
 
         payload = json.dumps(msg).encode("utf-8")

browser_cli/commands/serve.py

@@ -25,7 +25,7 @@ def _log(addr:tuple, command:str, profile:str|None, status:str, error:str|None=N
   else:
     console.print(f"[dim]{ts}[/dim] {addr_str} {profile_str}[cyan]{command}[/cyan] [green]{status}[/green]")
 
-def _proxy_request(client_sock:socket.socket, addr:tuple, profile:str|None, auth_keys:list[str]|None, auth_keys_path:"Path|None", nonce:str) -> None:
+def _proxy_request(client_sock:socket.socket, addr:tuple, profile:str|None, auth_keys:list[str]|None, auth_keys_path:"Path|None", nonce:str, pq_private_key=None) -> None:
   from browser_cli.client import _resolve_socket, BrowserNotConnected
   from browser_cli.platform import is_windows
 
@@ -92,8 +92,26 @@ def _proxy_request(client_sock:socket.socket, addr:tuple, profile:str|None, auth
       _send_error(msg_id, "unauthorized: untrusted public key")
       _log(addr, command, None, "DENIED", "untrusted key")
       return
+    pq_shared_secret = None
+    if pq_private_key is not None:
+      kex = msg.get("pq_kex") or {}
+      pq_required = parse_version(client_ver) >= parse_version("0.9.4")
+      if not isinstance(kex, dict) or kex.get("alg") != "ML-KEM-768" or not kex.get("ciphertext"):
+        if pq_required:
+          _send_error(msg_id, "unauthorized: post-quantum key exchange required")
+          _log(addr, command, None, "DENIED", "missing pq kex")
+          return
+      else:
+        try:
+          from browser_cli.auth import pq_kex_server_decapsulate
+          pq_shared_secret = pq_kex_server_decapsulate(pq_private_key, str(kex["ciphertext"]))
+        except Exception:
+          _send_error(msg_id, "unauthorized: invalid post-quantum key exchange")
+          _log(addr, command, None, "DENIED", "bad pq kex")
+          return
+
     from browser_cli.auth import verify
-    if not verify(pub, bytes.fromhex(nonce), msg, sig):
+    if not verify(pub, bytes.fromhex(nonce), msg, sig, pq_shared_secret):
       _send_error(msg_id, "unauthorized: invalid signature")
       _log(addr, command, None, "DENIED", "bad signature")
       return
@@ -140,7 +158,7 @@ def _proxy_request(client_sock:socket.socket, addr:tuple, profile:str|None, auth
   resolved_profile = msg.get("_route") or profile
 
   # ── strip protocol fields, apply request compat shim, forward ─────────────
-  strip = {"token", "_route", "pubkey", "sig", "user_agent"}
+  strip = {"token", "_route", "pubkey", "sig", "user_agent", "pq_kex"}
   clean_msg = {k: v for k, v in msg.items() if k not in strip}
   clean_msg = adapt_request(clean_msg, client_ver)
   clean_payload = json.dumps(clean_msg).encode()
@@ -192,17 +210,25 @@ def _handle_client(client_sock:socket.socket, addr:tuple, profile:str|None, auth
       else:
         auth_keys = None
       nonce = secrets.token_hex(32)
-      challenge = json.dumps({
+      pq_private_key = None
+      challenge_msg = {
         "type": "challenge",
         "nonce": nonce,
         "server_version": get_installed_version(),
         "min_client_version": PROTOCOL_MIN_CLIENT,
-      }).encode()
+      }
+      if auth_keys_path is not None:
+        from browser_cli.auth import PQ_KEX_ALG, pq_kex_server_keypair
+        pq_keypair = pq_kex_server_keypair()
+        if pq_keypair is not None:
+          pq_private_key, pq_public_key = pq_keypair
+          challenge_msg["pq_kex"] = {"alg": PQ_KEX_ALG, "public_key": pq_public_key.hex()}
+      challenge = json.dumps(challenge_msg).encode()
       try:
         _framed_send(client_sock, challenge)
       except OSError:
         return
-      _proxy_request(client_sock, addr, profile, auth_keys, auth_keys_path, nonce)
+      _proxy_request(client_sock, addr, profile, auth_keys, auth_keys_path, nonce, pq_private_key)
   finally:
     _CONN_LIMIT.release()