Add post-quantum remote auth key exchange

2026-05-05 10:34:28 +02:00
parent 30a42ba6d5
commit 98396a7c7e
7 changed files with 229 additions and 72 deletions
@@ -319,10 +319,15 @@ def _send_remote(endpoint: str, msg: dict, private_key=None) -> bytes | None:
                pass

        if nonce_hex and private_key is not None:
-            from browser_cli.auth import sign, public_key_hex
+            from browser_cli.auth import PQ_KEX_ALG, pq_kex_client_encapsulate, sign, public_key_hex
            nonce = bytes.fromhex(nonce_hex)
-            clean_msg = {k: v for k, v in msg.items() if k not in {"token", "pubkey", "sig"}}
-            sig = sign(private_key, nonce, clean_msg)
+            clean_msg = {k: v for k, v in msg.items() if k not in {"token", "pubkey", "sig", "pq_kex"}}
+            pq_shared_secret = None
+            kex = challenge.get("pq_kex") if isinstance(challenge, dict) else None
+            if isinstance(kex, dict) and kex.get("alg") == PQ_KEX_ALG and kex.get("public_key"):
+                ciphertext_hex, pq_shared_secret = pq_kex_client_encapsulate(str(kex["public_key"]))
+                clean_msg["pq_kex"] = {"alg": PQ_KEX_ALG, "ciphertext": ciphertext_hex}
+            sig = sign(private_key, nonce, clean_msg, pq_shared_secret)
            msg = {**clean_msg, "pubkey": public_key_hex(private_key), "sig": sig.hex()}

        payload = json.dumps(msg).encode("utf-8")