{"id":4193,"library":"pyhpke","title":"Python HPKE Implementation","description":"PyHPKE is a Python implementation of HPKE (Hybrid Public Key Encryption), providing mechanisms for authenticated encryption with associated data. It supports all HPKE modes and cipher suites defined in RFC9180. The library is currently at version 0.6.4 and maintains a regular release cadence with frequent minor updates and dependency bumps.","status":"active","version":"0.6.4","language":"python","source_language":"en","source_url":"https://github.com/dajiaji/pyhpke","tags":["cryptography","hpke","encryption","security","rfc9180"],"install":[{"cmd":"pip install pyhpke","lang":"bash","label":"Install PyHPKE"}],"dependencies":[{"reason":"Provides underlying cryptographic primitives.","package":"cryptography","optional":false}],"imports":[{"symbol":"CipherSuite","correct":"from pyhpke import CipherSuite"},{"symbol":"KEMKey","correct":"from pyhpke import KEMKey"},{"symbol":"KEMId","correct":"from pyhpke import KEMId"},{"symbol":"KDFId","correct":"from pyhpke import KDFId"},{"symbol":"AEADId","correct":"from pyhpke import AEADId"}],"quickstart":{"code":"from pyhpke import CipherSuite, KEMKey, KEMId, KDFId, AEADId\n\n# --- Sender Side ---\n# Define the HPKE cipher suite\nsuite_s = CipherSuite.new(\n    KEMId.DHKEM_X25519_HKDF_SHA256,\n    KDFId.HKDF_SHA256,\n    AEADId.AES128_GCM\n)\n\n# Recipient's public key (example PEM format)\npublic_key_pem = b\"\"\"-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VuAyEAoMfvlI5DN08JRFP2fhWvZ6vBEl28yFeS9O9YQUjNyCY=\n-----END PUBLIC KEY-----\"\"\"\npkr = KEMKey.from_pem(public_key_pem)\n\n# Create sender context and encapsulate key\nenc, sender = suite_s.create_sender_context(pkr)\n\n# Seal the message\nplaintext = b\"Hello world!\"\nciphertext = sender.seal(plaintext)\n\nprint(f\"Encapsulated Key: {enc.hex()}\")\nprint(f\"Ciphertext: {ciphertext.hex()}\")\n\n# --- Recipient Side ---\n# Define the same HPKE cipher suite\nsuite_r = CipherSuite.new(\n    KEMId.DHKEM_X25519_HKDF_SHA256,\n    KDFId.HKDF_SHA256,\n    AEADId.AES128_GCM\n)\n\n# Recipient's private key (example PEM format, corresponding to public_key_pem)\nprivate_key_pem = b\"\"\"-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VuBCIEIMAXvyHjAeXy9x4MXF6rwGbDKw7crgDriFTFXO+XsS1F\n-----END PRIVATE KEY-----\"\"\"\nskr = KEMKey.from_pem(private_key_pem)\n\n# Create recipient context and decapsulate key (using 'enc' from sender)\nrecipient = suite_r.create_recipient_context(enc, skr)\n\n# Open the message\ndecrypted_text = recipient.open(ciphertext)\n\nprint(f\"Decrypted Text: {decrypted_text.decode()}\")\nassert decrypted_text == plaintext","lang":"python","description":"This example demonstrates a basic HPKE 'Base' mode encryption and decryption flow. A sender creates a context using the recipient's public key, encapsulates a symmetric key, and seals a plaintext message. The recipient uses the encapsulated key and their private key to open the ciphertext."},"warnings":[{"fix":"Thoroughly review the codebase and cryptographic primitives or seek independent security audits for critical applications.","message":"The PyHPKE library has not undergone a formal security audit. Users should perform their own risk assessment before deploying it in production environments, especially for sensitive data.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Upgrade Python to 3.10 or newer (the current minimum supported version is 3.10) or pin pyhpke to a version prior to 0.6.0.","message":"Support for Python 3.8 was dropped in PyHPKE version 0.6.0. Users on Python 3.8 or older must upgrade their Python environment or use an earlier PyHPKE version (e.g., <0.6.0).","severity":"breaking","affected_versions":">=0.6.0"},{"fix":"Implement robust key management practices, securely generate and store keys, and use unique nonces for each encryption operation (e.g., using a secure random number generator).","message":"Cryptographic libraries require careful key management. Ensure private keys are stored securely, never hardcoded, and access is strictly controlled. Avoid nonce reuse for AEAD modes, as it can lead to severe security vulnerabilities.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'0.6.4':40 'associ':21 'authent':18 'bump':53 'cadenc':46 'cipher':29 'cryptographi':54 'current':37 'data':22 'defin':31 'depend':52 'encrypt':14,19,56 'frequent':48 'hpke':2,10,26,55 'hybrid':11 'implement':3,8 'key':13 'librari':35 'maintain':42 'mechan':16 'minor':49 'mode':27 'provid':15 'public':12 'pyhpk':4 'python':1,7 'regular':44 'releas':45 'rfc9180':33,58 'secur':57 'suit':30 'support':24 'updat':50 'version':39","created_at":"2026-04-12T03:44:55.803032+00:00","updated_at":"2026-04-16T18:29:35.681207+00:00","problems":[{"fix":"Install the package using pip: `pip install pyhpke`.","cause":"The 'pyhpke' package is not installed in the Python environment you are using, or there is a typo in the import statement.","error":"ModuleNotFoundError: No module named 'pyhpke'"},{"fix":"Ensure all arguments (e.g., plaintext/ciphertext, nonce, AAD) conform to the expected types and lengths for the selected `CipherSuite` and method. Refer to the `pyhpke` API documentation for specific parameter requirements.","cause":"This error typically occurs when one or more arguments passed to a pyhpke function (like `seal` or `open`) do not meet the expected type, format, or length requirements for the chosen HPKE cipher suite.","error":"ValueError: Invalid arguments"},{"fix":"Review the setup of the `CipherSuite` and the `sender_context`, ensuring that valid KEM, KDF, and AEAD identifiers are used, and that the recipient's public key is correctly formatted. Verify the plaintext and associated authenticated data (AAD) for any non-conformant values.","cause":"An internal error occurred during the encryption process, often indicating an invalid state in the sender context, incorrect cryptographic parameters, or issues with the provided keys or data.","error":"pyhpke.exceptions.SealError: Failed to encrypt the plain text."},{"fix":"Verify that the recipient's private key, the `enc` value obtained from the sender, the `nonce`, and the `aad` used during decryption exactly match those used during the original encryption. Ensure the correct `CipherSuite` is being used.","cause":"The provided ciphertext could not be successfully decrypted, likely due to a mismatch in cryptographic parameters, an incorrect private key, an invalid `enc` value, an incorrect nonce, or if the ciphertext or associated authenticated data (AAD) has been tampered with.","error":"pyhpke.exceptions.OpenError: Failed to decrypt the cipher text."}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"0.6.5","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/dajiaji/pyhpke","docs":null,"changelog":null,"pypi":"https://pypi.org/project/pyhpke/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","serialization"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-08-29","next_check":"2026-07-28","install_tag":null}}