Setup

HPKE setup functions (RFC 9180 §5.1). Creates encryption contexts for each mode.

class rfc9180.setup.HPKESetup(kem, kdf, aead)[source]

Bases: object

HPKE Setup functions (RFC 9180 §5.1).

Handles the setup phase of HPKE operations, creating encryption contexts for different HPKE modes.

Parameters:

  • kem (KEMBase) – Key Encapsulation Mechanism instance.

  • kdf (KDFBase) – Key Derivation Function instance.

  • aead (AEADBase) – Authenticated Encryption with Associated Data instance.

kem

Key Encapsulation Mechanism instance.

Type:

KEMBase

kdf

Key Derivation Function instance.

Type:

KDFBase

aead

Authenticated Encryption with Associated Data instance.

Type:

AEADBase

suite_id

HPKE suite identifier.

Type:

bytes

__init__(kem, kdf, aead)[source]
verify_psk_inputs(mode, psk, psk_id)[source]

Verify PSK inputs are consistent with the mode.

Parameters:

  • mode (HPKEMode) – HPKE mode.

  • psk (bytes) – Pre-shared key.

  • psk_id (bytes) – Pre-shared key identifier.

Raises:

ValueError – If PSK inputs are inconsistent with the mode.

Return type:

None

key_schedule(role, mode, shared_secret, info, psk, psk_id)[source]

Perform key schedule to derive encryption context.

Parameters:

  • role (str) – Context role (‘S’ for sender, ‘R’ for recipient).

  • mode (HPKEMode) – HPKE mode.

  • shared_secret (bytes) – Shared secret from KEM.

  • info (bytes) – Application-supplied information.

  • psk (bytes) – Pre-shared key.

  • psk_id (bytes) – Pre-shared key identifier.

Returns:

Encryption context for the specified role.

Return type:

ContextSender or ContextRecipient

Raises:

ValueError – If PSK inputs are inconsistent with the mode.

setup_base_sender(pkR, info)[source]

Setup Base mode for sender.

Parameters:

  • pkR (Key Object) – Recipient’s public key.

  • info (bytes) – Application-supplied information.

Returns:

Tuple of (encapsulated key, sender context).

Return type:

tuple

setup_base_recipient(enc, skR, info)[source]

Setup Base mode for recipient.

Parameters:

  • enc (bytes) – Encapsulated public key.

  • skR (Key Object) – Recipient’s private key.

  • info (bytes) – Application-supplied information.

Returns:

Recipient context.

Return type:

ContextRecipient

setup_psk_sender(pkR, info, psk, psk_id)[source]

Setup PSK mode for sender.

Parameters:

  • pkR (Key Object) – Recipient’s public key.

  • info (bytes) – Application-supplied information.

  • psk (bytes) – Pre-shared key (must have at least 32 bytes of entropy).

  • psk_id (bytes) – Pre-shared key identifier.

Returns:

Tuple of (encapsulated key, sender context).

Return type:

tuple

Raises:

ValueError – If PSK has insufficient entropy.

setup_psk_recipient(enc, skR, info, psk, psk_id)[source]

Setup PSK mode for recipient.

Parameters:

  • enc (bytes) – Encapsulated public key.

  • skR (Key Object) – Recipient’s private key.

  • info (bytes) – Application-supplied information.

  • psk (bytes) – Pre-shared key (must have at least 32 bytes of entropy).

  • psk_id (bytes) – Pre-shared key identifier.

Returns:

Recipient context.

Return type:

ContextRecipient

Raises:

ValueError – If PSK has insufficient entropy.

setup_auth_sender(pkR, info, skS)[source]

Setup Auth mode for sender.

Parameters:

  • pkR (Key Object) – Recipient’s public key.

  • info (bytes) – Application-supplied information.

  • skS (Key Object) – Sender’s private key.

Returns:

Tuple of (encapsulated key, sender context).

Return type:

tuple

setup_auth_recipient(enc, skR, info, pkS)[source]

Setup Auth mode for recipient.

Parameters:

  • enc (bytes) – Encapsulated public key.

  • skR (Key Object) – Recipient’s private key.

  • info (bytes) – Application-supplied information.

  • pkS (Key Object) – Sender’s public key.

Returns:

Recipient context.

Return type:

ContextRecipient

setup_auth_psk_sender(pkR, info, psk, psk_id, skS)[source]

Setup AuthPSK mode for sender.

Parameters:

  • pkR (Key Object) – Recipient’s public key.

  • info (bytes) – Application-supplied information.

  • psk (bytes) – Pre-shared key (must have at least 32 bytes of entropy).

  • psk_id (bytes) – Pre-shared key identifier.

  • skS (Key Object) – Sender’s private key.

Returns:

Tuple of (encapsulated key, sender context).

Return type:

tuple

Raises:

ValueError – If PSK has insufficient entropy.

setup_auth_psk_recipient(enc, skR, info, psk, psk_id, pkS)[source]

Setup AuthPSK mode for recipient.

Parameters:

  • enc (bytes) – Encapsulated public key.

  • skR (Key Object) – Recipient’s private key.

  • info (bytes) – Application-supplied information.

  • psk (bytes) – Pre-shared key (must have at least 32 bytes of entropy).

  • psk_id (bytes) – Pre-shared key identifier.

  • pkS (Key Object) – Sender’s public key.

Returns:

Recipient context.

Return type:

ContextRecipient

Raises:

ValueError – If PSK has insufficient entropy.