Archivecryptography
HPKE: Hybrid Encryption as a Standard Boring Primitive
One RFC that packages KEM, KDF, and AEAD so you stop inventing your own sealed-box format.
- Published
- Reading time
- 1 min read
HPKE (RFC 9180) standardizes public-key encryption of a message to a recipient: a KEM establishes a shared secret, a KDF derives keys, and an AEAD encrypts. It is the "sealed box" you would otherwise build incorrectly.
The shape
enc, ctx = SetupBaseS(pkR, info)
ct = Seal(ctx, aad, pt)
The sender transmits enc (encapsulated key) plus ct. The recipient runs SetupBaseR(enc, skR, info) and opens. info and aad bind context and associated data.
Why it matters
- Standardized cipher suites (
X25519-HKDF-SHA256,AES-128-GCM, ChaCha20 variants) instead of ad-hoc combinations. - Built-in export for deriving additional secrets.
- Test vectors, so implementations interoperate.
Caveats
- HPKE is not a full protocol: no identity binding, no replay protection, no transcript.
- Authentication modes exist (auth PSK, auth KEM) but must be chosen deliberately.
Takeaway: for one-shot public-key encryption, HPKE replaces a pile of custom crypto. For sessions, you still need a protocol around it.