feat(pku2u): close Windows parity gaps (#733)

## Prerequisite fixes

Merged into `master` and consumed by this branch:

- [#736](#736) — propagate
Kerberos `EXTENDED_ERROR` and `IDENTIFY` GSS request flags
- [#737](#737) — generate
Kerberos MICs with the negotiated AES-128/AES-256 size

## Summary

Closes the PKU2U gaps identified by comparing `sspi-rs` with Windows 11
`pku2u.dll` 10.0.26100.8737 and the MS-PKU2U/MS-NEGOEX specifications.

- completes the PKU2U initiator and acceptor state machines, including
PKINIT AS, Ticket/AP, Finished, VERIFY, and channel-binding flows
- adds negotiated MIC, signature, sealed Wrap, and integrity-only Wrap
support with strict direction, sequence, header, EC/RRC, and buffer
validation
- aligns package metadata, SPNEGO/NEGOEX routing and mechanism
selection, checksum selection, GSS flags, nonce handling, and KRB-ERROR
propagation
- hardens CMS signer/content binding, exact peer-certificate trust,
certificate time/usage policy, DH parameter validation, and bounded
process-wide authenticator replay protection
- replaces the captured machine identifier with a cryptographically
random process-lifetime identifier matching MS-KILE per-boot semantics
- supports multiple credentials and Windows CNG-backed non-exportable
private keys
- exposes portable peer-name, peer-certificate, and certificate-trust
context queries
- adds end-to-end coverage and production-path malformed-token fuzzing

## PKU2U parity roadmap

- [x] package metadata and context-size parity
- [x] negotiated checksum and GSS flag handling
- [x] MIC, signature, channel binding, and per-direction sequence state
- [x] sealed and integrity-only multi-buffer Wrap/Unwrap
- [x] correct SPNEGO/NEGOEX layering, mechanism selection, and routing
- [x] CMS content, signer, nonce, and KRB-ERROR validation
- [x] trust metadata, credential selection, and non-exportable CNG keys
- [x] complete secured PKU2U acceptor
- [x] exact client/server certificate trust and certificate-bound
principals
- [x] allowlisted DH parameters and full-window cross-context replay
protection
- [x] portable peer-name, certificate, and trust context queries
- [x] end-to-end, tamper, replay, and malformed framing tests
- [x] dedicated PKU2U fuzz target using the production NEGOEX parsers
- [x] final IDA-parity and security audit

## Static-analysis follow-up

- [x] trace peer-certificate policy: both directions call
`IntPstValidate` with the current system time and role
- [x] enforce certificate validity, digital-signature KeyUsage, and
PKINIT/client-auth EKU before trust decisions
- [x] trace machine identity to LSA supplemental token information and
replace the captured constant with per-process/per-boot random state
- [x] map Windows ticket-cache keys, contents, expiry, invalidation, and
cache-hit AS bypass
- [x] verify this Windows build accepts only DH `PA-PK-AS-REP`;
`encKeyPack` is intentionally not implemented
- [x] map package context attributes plus native token/export/import
surfaces
- [ ] implement cross-context ticket reuse — blocked on real-wire
confirmation of cache-hit Finished/VERIFY transcript semantics and
acceptor long-term ticket-key lifecycle

## Validation

- `cargo test -p sspi --all-features`
- `cargo clippy -p sspi --all-targets --all-features -- -D warnings -A
clippy::non_ascii_literal`
- `cargo +nightly fuzz build pku2u_tokens`

The current host has no `MS-Organization-P2P-Access` certificate with a
private key, so real Windows wire capture and safe implementation of
ticket-cache handshake bypass remain outside the statically verified
scope.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mamoreau-devolutions

fuzz/Cargo.toml

@@ -11,7 +11,7 @@ cargo-fuzz = true
 [dependencies]
 dpapi-fuzzing.path = "../crates/dpapi-fuzzing"
 libfuzzer-sys = "0.4"
-sspi.path = ".."
+sspi = { path = "..", features = ["__test-data"] }
 
 # Prevent this from interfering with workspaces
 [workspace]
@@ -34,3 +34,10 @@ path = "fuzz_targets/dpapi_decoding.rs"
 test = false
 doc = false
 bench = false
+
+[[bin]]
+name = "pku2u_tokens"
+path = "fuzz_targets/pku2u_tokens.rs"
+test = false
+doc = false
+bench = false

fuzz/fuzz_targets/pku2u_tokens.rs

@@ -0,0 +1,7 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    sspi::pku2u::fuzz_token(data);
+});

src/auth_identity.rs

@@ -206,6 +206,14 @@ impl Username {
         })
     }
 
+    pub(crate) fn new_qualified_down_level_logon_name(account_name: &str, netbios_domain_name: &str) -> Self {
+        Self {
+            value: format!("{netbios_domain_name}\\{account_name}"),
+            format: UserNameFormat::DownLevelLogonName,
+            sep_idx: Some(netbios_domain_name.len()),
+        }
+    }
+
     /// Attempts to guess the right name format for the account name/domain combo
     ///
     /// If no netbios domain name is provided, or if it is an empty string, the username will

src/kerberos/mod.rs

@@ -7,7 +7,7 @@ mod pa_datas;
 pub mod server;
 #[cfg(test)]
 mod tests;
-mod utils;
+pub(crate) mod utils;
 
 use std::fmt::Debug;
 use std::sync::LazyLock;

src/kerberos/utils.rs

@@ -21,7 +21,7 @@ pub(super) fn serialize_message<T: ?Sized + Serialize>(v: &T) -> Result<Vec<u8>>
     Ok(data)
 }
 
-pub(super) fn validate_mic_token(
+pub(crate) fn validate_mic_token(
     is_client: bool,
     expected_seq_number: u64,
     raw_token: &[u8],
@@ -97,7 +97,7 @@ pub(super) fn validate_mic_token(
     Ok(())
 }
 
-pub(super) fn generate_mic_token(
+pub(crate) fn generate_mic_token(
     is_client: bool,
     seq_number: u64,
     mut payload: Vec<u8>,

src/lib.rs

@@ -124,7 +124,7 @@ pub use self::negotiate::client::FALLBACK_ERROR_KINDS;
 pub use self::negotiate::{Negotiate, NegotiateConfig, NegotiatedProtocol};
 pub use self::ntlm::Ntlm;
 pub use self::ntlm::hash::{NTLM_HASH_PREFIX, NtlmHash, NtlmHashError};
-pub use self::pku2u::{Pku2u, Pku2uConfig, Pku2uState};
+pub use self::pku2u::{Pku2u, Pku2uConfig, Pku2uCredential, Pku2uPrivateKey, Pku2uState};
 pub use self::secret::Secret;
 use crate::builders::{
     EmptyAcceptSecurityContext, EmptyAcquireCredentialsHandle, EmptyInitializeSecurityContext,

src/negotiate/client.rs

@@ -85,6 +85,16 @@ pub(crate) async fn initialize_security_context<'a>(
         }
     }
 
+    // PKU2U contains its own SPNEGO/NEGOEX exchange. Wrapping it in this
+    // Negotiate context again would advertise NTLM while carrying a nested
+    // SPNEGO token, which Windows rejects.
+    if matches!(negotiate.protocol, NegotiatedProtocol::Pku2u(_)) {
+        return negotiate
+            .protocol
+            .initialize_security_context(negotiate.auth_identity.as_ref(), yield_point, builder)
+            .await;
+    }
+
     match negotiate.state {
         NegotiateState::Initial => {
             if builder

src/negotiate/config.rs

@@ -4,6 +4,9 @@ use crate::{NegotiatedProtocol, Result};
 
 pub trait ProtocolConfig: Debug + Send + Sync {
     fn new_instance(&self) -> Result<NegotiatedProtocol>;
+    fn new_server_instance(&self) -> Result<NegotiatedProtocol> {
+        self.new_instance()
+    }
     fn box_clone(&self) -> Box<dyn ProtocolConfig>;
 }
 

src/negotiate/mod.rs

@@ -276,7 +276,11 @@ impl Negotiate {
     }
 
     fn new(config: NegotiateConfig, mode: NegotiateMode) -> Result<Self> {
-        let mut protocol = config.protocol_config.new_instance()?;
+        let mut protocol = if mode.is_client() {
+            config.protocol_config.new_instance()?
+        } else {
+            config.protocol_config.new_server_instance()?
+        };
 
         let package_list = PackageListConfig::parse(&config.package_list);
         if let Some(filtered_protocol) =

src/negotiate/server.rs

@@ -22,6 +22,13 @@ pub(crate) async fn accept_security_context(
     yield_point: &mut YieldPointLocal,
     mut builder: FilledAcceptSecurityContext<'_, <Negotiate as SspiImpl>::CredentialsHandle>,
 ) -> Result<AcceptSecurityContextResult> {
+    if matches!(negotiate.protocol, NegotiatedProtocol::Pku2u(_)) {
+        return negotiate
+            .protocol
+            .accept_security_context(yield_point, &mut builder)
+            .await;
+    }
+
     let input = builder
         .input
         .as_mut()