[WIP]: Managed HPKE - #133804

Draft

vcsjones wants to merge 43 commits into

dotnet:mainfrom

vcsjones:hpke-impl

Commits on Sep 5, 2026

Add experimental HPKE cipher suite descriptors

vcsjones
and
Copilot
committed
f8e9316
Complete HpkeSuite metadata and public API

vcsjones
and
Copilot
committed
68258cf
Add managed HPKE foundation

vcsjones
and
Copilot
committed
939cd7d
Split managed HPKE KEM adapters

vcsjones
and
Copilot
committed
e87f872

Commits on Sep 6, 2026

Add HPKE key factory APIs

vcsjones
and
Copilot
committed
f57271e

Commits on Sep 7, 2026

Implement HPKE decapsulation key export

vcsjones
and
Copilot
committed
fa21cda
Implement HPKE encapsulation key export

vcsjones
and
Copilot
committed
d035fc0
Checkpoint HPKE Seal and managed AEAD adapters

vcsjones
and
Copilot
committed
f589d5a

Commits on Sep 8, 2026

Add HPKE KEM encapsulation and key schedule adapters

vcsjones
and
Copilot
committed
e621f1c
Implement HPKE single-shot sealing

vcsjones
and
Copilot
committed
ce437ba
Use stack buffers for fixed-size HPKE intermediates

vcsjones
and
Copilot
committed
7ea28a5
Implement HPKE single-shot opening

vcsjones
and
Copilot
committed
576af50
Add abstract HPKE sender and recipient contexts

vcsjones
and
Copilot
committed
6e25e20
Implement stateful HPKE sender creation and sealing

vcsjones
and
Copilot
committed
1b0907f
Implement stateful HPKE recipient creation and opening

vcsjones
and
Copilot
committed
c2ff6cd
Implement HPKE PSK sender and recipient modes

vcsjones
and
Copilot
committed
cfc2d3b
Implement P-521 DHKEM support for HPKE

vcsjones
and
Copilot
committed
8f4fd22

Commits on Sep 9, 2026

Implement HPKE context secret export

vcsjones
and
Copilot
committed
a798ae5
Implement HPKE key import APIs

vcsjones
and
Copilot
committed
4a10e1d
Reject concurrent HPKE sender sealing

vcsjones
and
Copilot
committed
6f8aa63
Validate HPKE sender buffer overlaps

vcsjones
and
Copilot
committed
4152869
Complete HPKE single-shot API documentation

vcsjones
and
Copilot
committed
9d8e8b6
Fix HPKE target wiring in Microsoft.Bcl.Cryptography

vcsjones
and
Copilot
committed
0961d98
Validate HPKE Open and Export buffer overlaps

vcsjones
and
Copilot
committed
6a80474
Refine HPKE validation order and temporary buffers

vcsjones
and
Copilot
committed
32f473c

Commits on Sep 10, 2026

Remove redundant HPKE key-schedule output staging

vcsjones
and
Copilot
committed
850ea5f
Stop clearing non-secret HPKE buffers

vcsjones
and
Copilot
committed
b26bfdd
Derive HPKE KEM suite IDs from enum values

vcsjones
and
Copilot
committed
f0afdec
Assert the internal HPKE export-length invariant

vcsjones
and
Copilot
committed
9badba1
Reuse the KDF adapter across HPKE key operations

vcsjones
and
Copilot
committed
68535fa
Stream HPKE SHAKE inputs through public APIs

vcsjones
and
Copilot
committed
60e3a09
Merge remote-tracking branch 'ms/main' into hpke-impl
vcsjones
committed
52c1bc7

Commits on Sep 11, 2026

Add shared HPKE contract tests

vcsjones
and
Copilot
committed
6624230
Add a representative HPKE test-vector corpus

vcsjones
and
Copilot
committed
eac840c
Bound HPKE test exporter contexts to 1024 bytes

vcsjones
and
Copilot
committed
7dad5f4
Add shared HPKE sender and recipient contract tests

vcsjones
and
Copilot
committed
b2b0339

Commits on Sep 12, 2026

Add shared HPKE key tests and prune legacy tests

vcsjones
and
Copilot
committed
af31501
Add shared HPKE implementation tests

vcsjones
and
Copilot
committed
a4318a9
Simplify HPKE recipient documentation

vcsjones
and
Copilot
committed
c37a857
Simplify HPKE sender and suite documentation

vcsjones
and
Copilot
committed
93cf8e5
Separate HPKE static validation from instance contracts

vcsjones
and
Copilot
committed
627779e
Refine HPKE export tests and browser build exclusions

vcsjones
and
Copilot
committed
2d362f9
Add comment clarifying why OpenCore does not have a concurrency guard
vcsjones
committed
befd9b0