[RFC,WIP] implement PQC PSK key exchange handshake by jonasjelonek · Pull Request #5 · openwrt/unetd

jonasjelonek · 2025-07-25T09:49:05Z

implements PQC PSK key exchange for unetd

Just as RFC for the handshake/key exchange process and how it's implemented.

This is still missing proper integration into unetd's internals, especially pex message send/recv flow.
This doesn't compile nor run yet.

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Try getrandom/arc4random first, only fall back to /dev/urandom when necessary Signed-off-by: Felix Fietkau <nbd@nbd.name>

This will be used for quantum safe handshakes Signed-off-by: Felix Fietkau <nbd@nbd.name>

Used for ML-DSA Signed-off-by: Felix Fietkau <nbd@nbd.name>

Used for post-quantum signatures Signed-off-by: Felix Fietkau <nbd@nbd.name>

Signed-off-by: Felix Fietkau <nbd@nbd.name>

nbd168

Seems like a good start! Added a few comments...

implements PQC PSK key exchange for unetd THIS IS UNFINISHED AND DOES NOT WORK YET! Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

jonasjelonek

addressed all comments, split up messages, removed unnecessary (for now) changes

jonasjelonek · 2025-08-13T08:48:48Z

+	return last == 0 || now - last > HANDSHAKE_INTERVAL;
+}
+
+/* This should be called regularly by some kind of timer */


@nbd168 should this get its own timer or can we reuse one of the existing timers like request_update_timer or connect_timer?

I think it should get its own timer.

jonasjelonek · 2025-08-13T08:49:16Z

+	resp->last_handshake_time = peer->state.last_psk_handshake;
+	resp->need_handshake = psk_kex_need_handshake(peer);
+
+	pex_msg_send_ext(net, peer, /* address outside of tunnel */ addr);


@nbd168 how may I get the address to send this to the "peer" outside of the tunnel on global pex port?

You should go through all addresses in peer->state.next_endpoint, possibly checking for duplicates.

For my understanding:

what's the point of the different endpoint types?

why couldn't I just use peer->state.endpoint or peer->state.next_endpoint[ENDPOINT_TYPE_PEX] as destination?

ENDPOINT_TYPE_PEX is an endpoint address received from another host.
ENDPOINT_TYPE_ENDPOINT_NOTIFY and ENDPOINT_TYPE_ENDPOINT_PORT_NOTIFY are endpoint addresses received from peers directly (former from the PEX port, latter from the wireguard port).

If you don't have any peer connection yet, the ENDPOINT_TYPE_PEX will not be filled. Peers for other hosts are only exchanged over the tunnel.
As for the other types, availability depends on which packets make it through, especially in the NAT case. When the basic work on the handshake is done, we may need to add some improvements to NAT handling, since there will be some limitations compared to non-PEX handshake.

jonasjelonek · 2025-08-13T08:49:46Z

+	default: return;
+	}
+
+	// TBD: do we need to explicitly trigger a network update to use the new PSK or does that work automatically?


@nbd168 do you know?

You can do a wg_peer_update(net, peer, WG_PEER_UPDATE) call directly in order to upload the new psk for the peer to wireguard. Afterwards it should work on the next automatic handshake attempt.

nbd168 · 2025-08-19T18:14:43Z

+	return last == 0 || now - last > HANDSHAKE_INTERVAL;
+}
+
+/* This should be called regularly by some kind of timer */


I think it should get its own timer.

nbd168 · 2025-08-19T18:19:03Z

+	if (peer->kex_ctx.role != PSK_KEX_ROLE_INITIATOR)
+		return;
+
+	/* TBD: Can we send two messages in a row without issues? */


I would recommend splitting the sending of messages from initializing the key exchange state. Messages may have to be retransmitted over unreliable networks, and it would be good to not have to redo the keygen part each time.

I also think it might be useful to encrypt the initial messages with a key derived from curve25519 DH, which can be calculated once per peer ahead of time. That reduces the DoS potential of expensive PQ crypto, as long as the non-PQ crypto has not been cracked yet.

nbd168 · 2025-08-19T18:27:08Z

+	resp->last_handshake_time = peer->state.last_psk_handshake;
+	resp->need_handshake = psk_kex_need_handshake(peer);
+
+	pex_msg_send_ext(net, peer, /* address outside of tunnel */ addr);


You should go through all addresses in peer->state.next_endpoint, possibly checking for duplicates.

nbd168 · 2025-08-19T18:28:25Z

+	default: return;
+	}
+
+	// TBD: do we need to explicitly trigger a network update to use the new PSK or does that work automatically?


You can do a wg_peer_update(net, peer, WG_PEER_UPDATE) call directly in order to upload the new psk for the peer to wireguard. Afterwards it should work on the next automatic handshake attempt.

nbd168 added 9 commits July 8, 2025 23:37

chacha20.h: add missing includes

997ce23

Signed-off-by: Felix Fietkau <nbd@nbd.name>

lib: add utility function for getting random data

37e3133

Try getrandom/arc4random first, only fall back to /dev/urandom when necessary Signed-off-by: Felix Fietkau <nbd@nbd.name>

lib: add sntrup761 code

8c26012

This will be used for quantum safe handshakes Signed-off-by: Felix Fietkau <nbd@nbd.name>

lib: add shake / fips202

0f656a5

Used for ML-DSA Signed-off-by: Felix Fietkau <nbd@nbd.name>

lib: add ML-DSA 44 code

a9e9011

Used for post-quantum signatures Signed-off-by: Felix Fietkau <nbd@nbd.name>

mldsa: implement function for deriving public key from secret key

dfe642e

Signed-off-by: Felix Fietkau <nbd@nbd.name>

sntrup761: add function for deriving public key from secret key

3e486ba

Signed-off-by: Felix Fietkau <nbd@nbd.name>

mldsa: add support for passing seed to the keygen

8853edd

Signed-off-by: Felix Fietkau <nbd@nbd.name>

cli: add support for generating pq host/signing keys

05a050e

Signed-off-by: Felix Fietkau <nbd@nbd.name>

jonasjelonek marked this pull request as draft July 25, 2025 09:53

nbd168 reviewed Jul 25, 2025

View reviewed changes

Comment thread wg-linux.c Outdated

Comment thread psk-kex.h

Comment thread host.c Outdated

Comment thread host.c Outdated

Comment thread CMakeLists.txt

aparcar reviewed Aug 11, 2025

View reviewed changes

Comment thread CMakeLists.txt Outdated

WIP: PQC PSK key exchange handshake

63d328c

implements PQC PSK key exchange for unetd THIS IS UNFINISHED AND DOES NOT WORK YET! Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

jonasjelonek force-pushed the pqc branch from 1a5d90b to 63d328c Compare August 13, 2025 08:45

jonasjelonek commented Aug 13, 2025

View reviewed changes

nbd168 reviewed Aug 19, 2025

View reviewed changes

openwrt-bot force-pushed the pqc branch from 05a050e to f96694b Compare February 16, 2026 18:28

Conversation

jonasjelonek commented Jul 25, 2025

Uh oh!

nbd168 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jonasjelonek left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants