[sarroutbi]

This PR adds a new tang-pqc pin implementing hybrid ECC+ML-KEM post-quantum encryption for Tang-based NBDE (Network-Bound Disk Encryption). This protects LUKS bindings against future quantum attacks while retaining classical ECMR security guarantees through a dual key exchange design.

• clevis-encrypt-tang-pqc / clevis-decrypt-tang-pqc: Standalone encrypt/decrypt commands implementing the hybrid protocol
• Core modules: jose_wrapper (jose C API bindings), tang_client (HTTP client for tang endpoints), key_deriver (HKDF-SHA256 key combination), ecmr_ops (EC key blinding/unblinding)
• Protocol flow:
  • Encrypt: Performs classical ECMR key exchange via /rec/{kid}, then ML-KEM encapsulation against the server's KEM public key from /adv-kem. Both shared secrets are combined via HKDF-SHA256 (NBDE-HYBRID-v1 label) to derive the final encryption key
  • Decrypt: Recovers the classical ECMR secret via /rec/{kid}, then uses a bidirectional KEM-secured transport channel (/rec-kem/{kem_kid}) to recover the KEM shared secret. Both are recombined to reconstruct the encryption key
• Secure transport layer: The /rec-kem recovery channel uses ML-KEM encapsulation in both directions (client-to-server and server-to-client) to protect the KEM key material in transit
• Offline binding: Supports providing both adv and adv_kem as file paths or inline JSON for air-gapped provisioning

KEM Algorithm Selection (alg config property)

The tang-pqc pin now supports an optional alg configuration property that allows selecting which ML-KEM parameter set to use for hybrid encryption. If omitted, the default remains ML-KEM-768
(NIST security level 3), preserving full backward compatibility.

• Default (ML-KEM-768):
  clevis luks bind -d /dev/sda1 tang-pqc '{"url":"http://tang.example.com"}'
• Explicit algorithm selection:
  clevis luks bind -d /dev/sda1 tang-pqc '{"url":"http://tang.example.com","alg":"ML-KEM-1024"}'

Supported values:

• ML-KEM-512
• ML-KEM-768
• ML-KEM-1024

LUKS infrastructure integration

• clevis-luks-common-functions: Adds tang-pqc to SSS pin listing, config printing, and regen support
• clevis-luks-report: Handles tang-pqc pin for key rotation detection; supports tang_pub mode (no stored adv) by checking the kid thumbprint against the server's current advertisement
• clevis-luks-bind: Finds tang-pqc pin executables in the correct path
• Dracut module (clevis-pin-tang-pqc): Includes tang-pqc binaries and shared libraries in the initramfs for early-boot unlocking
• Initramfs-tools hook: Adds tang-pqc binaries to initramfs on Debian-based systems

Build system

• New meson option tang-pqc (default: auto) to control pin compilation
• Dependencies: jose (with ML-KEM KEM API), libcrypto (OpenSSL 3.5+), libcurl, jansson
• Compile-time cc.links() check for jose_jwk_kem_enc to gate build on jose ML-KEM API availability
• C++ unit tests for jose_wrapper, key_deriver, and ecmr_ops modules

Test suite

• C++ unit tests: test-tang-pqc-jose-wrapper, test-tang-pqc-key-deriver, test-tang-pqc-ecmr-ops
• Integration tests: pin-tang-pqc (basic round-trip), pin-tang-pqc-version (/version and /adv-kem endpoint validation), pin-tang-pqc-offline (offline binding with file/inline adv), pin-tang-pqc-sss (SSS threshold policies with tang-pqc), pin-tang-pqc-errors (error handling)
• Existing test fix: bind-luks1-avoid-luksmeta-corruption adapted to force adv storage (bypasses tang_pub optimization)

Documentation

• README.md updated with tang-pqc pin usage, dependencies table, and tang server requirements