As a PAM module, I need to implement offline credential cache

[guimard]

User Story

As the PAM module,
I need to implement offline credential caching,
So that users can authenticate when LLNG is unreachable.

Acceptance Criteria

• New offline_cache module (offline_cache.c/h)
• Argon2id password hashing
• AES-256-GCM encryption for user data
• PBKDF2 key derivation
• Cache file format with header + encrypted payload
• Expiration checking
• Secure file permissions (0600, root only)

Technical Details

Cache File Format

Location: /var/lib/pam_llng/offline/<username>.enc

┌──────────────────────────────────────────┐
│ Header (unencrypted)                     │
│ - magic: "LLNGOFFLINE01"                 │
│ - created_at: timestamp                  │
│ - expires_at: timestamp                  │
│ - password_hash: Argon2id hash           │
│ - salt: 16 bytes random                  │
├──────────────────────────────────────────┤
│ Payload (AES-256-GCM encrypted)          │
│ - IV: 12 bytes                           │
│ - Ciphertext:                            │
│   - username                             │
│   - uid, gid                             │
│   - gecos, shell, home                   │
│   - groups[]                             │
│ - Auth tag: 16 bytes                     │
└──────────────────────────────────────────┘

Crypto Parameters

• Argon2id: 19 MiB memory, 2 iterations, 32 byte output
• PBKDF2: HMAC-SHA256, 100,000 iterations, 32 byte output
• AES-256-GCM: 12 byte IV, 16 byte auth tag

API

// Create/update cache
int offline_cache_store(const char *username,
                        const char *password,
                        const user_info_t *info,
                        int expiration_days);

// Verify password and retrieve cached info
int offline_cache_verify(const char *username,
                         const char *password,
                         user_info_t *info);

// Check if cache exists and is valid
int offline_cache_exists(const char *username);

Dependencies

• libargon2-dev (Debian) / libargon2-devel (RHEL)
• OpenSSL (already used)

Files to Create/Modify

• include/offline_cache.h (new)
• src/offline_cache.c (new)
• CMakeLists.txt: add libargon2

Component

Repo: llng-pam-module (C)