hpke

Documentation

Overview

Package hpke provides HPKE encryption/decryption functionality.

Index

• type HpkeRecipient
  • func NewHpkeRecipient() (*HpkeRecipient, error)
  • func (r *HpkeRecipient) Decrypt(encapsulatedKey []byte, ciphertext []byte) ([]byte, error)
• type HpkeSender
  • func NewHpkeSender() *HpkeSender
  • func (s *HpkeSender) Encrypt(recipientPubKey []byte, plaintext []byte) (encapsulatedKey []byte, ciphertext []byte, err error)

Types

type HpkeRecipient

type HpkeRecipient struct {
	// PublicKeySpki is the SPKI-encoded public key bytes (for sharing with senders)
	PublicKeySpki []byte
	// contains filtered or unexported fields
}

HpkeRecipient handles HPKE decryption operations using P-256/HKDF-SHA256/ChaCha20-Poly1305. It is safe for concurrent use as it only holds immutable cryptographic material.

func NewHpkeRecipient

func NewHpkeRecipient() (*HpkeRecipient, error)

NewHpkeRecipient generates a new HPKE recipient with a fresh P-256 keypair. Returns error if key generation fails.

func (*HpkeRecipient) Decrypt

func (r *HpkeRecipient) Decrypt(encapsulatedKey []byte, ciphertext []byte) ([]byte, error)

Decrypt decrypts HPKE-encrypted data using the recipient's private key. Parameters:

• encapsulatedKey: The HPKE encapsulated key from the sender
• ciphertext: The encrypted data

Returns:

• Decrypted plaintext bytes
• Error if decryption fails (invalid key, corrupted data, auth failure)

type HpkeSender

type HpkeSender struct {
	// contains filtered or unexported fields
}

HpkeSender handles HPKE encryption operations using P-256/HKDF-SHA256/ChaCha20-Poly1305.

func NewHpkeSender

func NewHpkeSender() *HpkeSender

NewHpkeSender creates a new HPKE sender configured with the same cipher suite as the recipient (P-256/HKDF-SHA256/ChaCha20-Poly1305).

func (*HpkeSender) Encrypt

func (s *HpkeSender) Encrypt(recipientPubKey []byte, plaintext []byte) (encapsulatedKey []byte, ciphertext []byte, err error)

Encrypt encrypts plaintext using the recipient's public key. Returns the HPKE encapsulated key and ciphertext.