hpke

Hybrid Public Key Encryption (RFC 9180) for OCaml. Encrypt to a recipient's public key; decrypt with their private key.

Requires 64-bit OCaml 4.14+ and Dune 3.12+. No release is supported for production use yet. Read the security model.

Get started

opam install hpke

Add the library and a Unix RNG to your executable:

(executable
 (name main)
 (libraries hpke mirage-crypto-rng.unix))

Follow the runnable example to generate keys, encrypt a message, and decrypt it.

Choose an API

One message

Rfc9180.seal_base and open_base create a fresh context for each message.

Several ordered messages

Set up sender and receiver contexts once, then seal and open messages in order.

Derive keys

Use context export. Suite.export_only creates a suite without encryption.

Base mode does not authenticate the sender. PSK adds a shared secret; Auth adds a sender key; AuthPSK combines both.

Algorithms

• KEM: P-256, P-384, P-521, X25519, X448; ML-KEM-512, -768, -1024; MLKEM768-P256, MLKEM768-X25519 (X-Wing), MLKEM1024-P384.
• KDF: HKDF-SHA256, -SHA384, -SHA512; SHAKE128 and SHAKE256 in Hpke.Draft_hpke_04.
• AEAD: AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305.

ML-KEM, hybrid KEMs, and Draft_hpke_04 support Base and PSK only. Hybrid KEMs and Draft_hpke_04 require 0.4.0 or newer; see installation options. The ciphersuite reference lists identifiers and sizes.

Reference

• Usage: keys, modes, contexts, exports, errors.
• Public API: signatures and error contracts.
• Development: builds, tests, contributions.
• Changelog: release history and compatibility.

License: ISC.