peer_pqc.c

// SPDX-License-Identifier: GPL-2.0
/*
 * WireGuard PQC Extension - Peer PQC Key Management
 */

#include "peer.h"
#include "noise.h"
#include "crypto_mode.h"

#include <linux/slab.h>
#include <linux/string.h>

/*
 * Stores the peer's remote ML-KEM-512 public key and propagates it into the
 * handshake structure so it is available when building the initiation message.
 */
int wg_peer_set_pqc_remote_key(struct wg_peer *peer,
			       const u8 *pqc_public_key)
{
	if (!peer->pqc_keys.remote_static_public) {
		peer->pqc_keys.remote_static_public = kzalloc(MLKEM512_PUBLIC_KEY_LEN,
							      GFP_KERNEL);
		if (!peer->pqc_keys.remote_static_public)
			return -ENOMEM;
	}

	memcpy(peer->pqc_keys.remote_static_public, pqc_public_key,
	       MLKEM512_PUBLIC_KEY_LEN);
	peer->pqc_keys.has_pqc_keys = true;

	return wg_noise_set_pqc_remote_static(&peer->handshake, pqc_public_key);
}

/* Zeroes and frees the peer's cached PQC public key. */
void wg_peer_clear_pqc_keys(struct wg_peer *peer)
{
	if (peer->pqc_keys.remote_static_public) {
		memzero_explicit(peer->pqc_keys.remote_static_public,
				 MLKEM512_PUBLIC_KEY_LEN);
		kfree(peer->pqc_keys.remote_static_public);
		peer->pqc_keys.remote_static_public = NULL;
	}
	peer->pqc_keys.has_pqc_keys = false;
}