xref: /aosp_15_r20/external/boringssl/src/include/openssl/hpke.h (revision 8fb009dc861624b67b6cdb62ea21f0f22d0c584b)
1 /* Copyright (c) 2020, Google Inc.
2  *
3  * Permission to use, copy, modify, and/or distribute this software for any
4  * purpose with or without fee is hereby granted, provided that the above
5  * copyright notice and this permission notice appear in all copies.
6  *
7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14 
15 #ifndef OPENSSL_HEADER_CRYPTO_HPKE_INTERNAL_H
16 #define OPENSSL_HEADER_CRYPTO_HPKE_INTERNAL_H
17 
18 #include <openssl/aead.h>
19 #include <openssl/base.h>
20 #include <openssl/curve25519.h>
21 #include <openssl/digest.h>
22 
23 #if defined(__cplusplus)
24 extern "C" {
25 #endif
26 
27 
28 // Hybrid Public Key Encryption.
29 //
30 // Hybrid Public Key Encryption (HPKE) enables a sender to encrypt messages to a
31 // receiver with a public key.
32 //
33 // See RFC 9180.
34 
35 
36 // Parameters.
37 //
38 // An HPKE context is parameterized by KEM, KDF, and AEAD algorithms,
39 // represented by |EVP_HPKE_KEM|, |EVP_HPKE_KDF|, and |EVP_HPKE_AEAD| types,
40 // respectively.
41 
42 // The following constants are KEM identifiers.
43 #define EVP_HPKE_DHKEM_X25519_HKDF_SHA256 0x0020
44 
45 // The following functions are KEM algorithms which may be used with HPKE. Note
46 // that, while some HPKE KEMs use KDFs internally, this is separate from the
47 // |EVP_HPKE_KDF| selection.
48 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_hpke_x25519_hkdf_sha256(void);
49 
50 // EVP_HPKE_KEM_id returns the HPKE KEM identifier for |kem|, which
51 // will be one of the |EVP_HPKE_KEM_*| constants.
52 OPENSSL_EXPORT uint16_t EVP_HPKE_KEM_id(const EVP_HPKE_KEM *kem);
53 
54 // EVP_HPKE_MAX_PUBLIC_KEY_LENGTH is the maximum length of an encoded public key
55 // for all KEMs currently supported by this library.
56 #define EVP_HPKE_MAX_PUBLIC_KEY_LENGTH 32
57 
58 // EVP_HPKE_KEM_public_key_len returns the length of a public key for |kem|.
59 // This value will be at most |EVP_HPKE_MAX_PUBLIC_KEY_LENGTH|.
60 OPENSSL_EXPORT size_t EVP_HPKE_KEM_public_key_len(const EVP_HPKE_KEM *kem);
61 
62 // EVP_HPKE_MAX_PRIVATE_KEY_LENGTH is the maximum length of an encoded private
63 // key for all KEMs currently supported by this library.
64 #define EVP_HPKE_MAX_PRIVATE_KEY_LENGTH 32
65 
66 // EVP_HPKE_KEM_private_key_len returns the length of a private key for |kem|.
67 // This value will be at most |EVP_HPKE_MAX_PRIVATE_KEY_LENGTH|.
68 OPENSSL_EXPORT size_t EVP_HPKE_KEM_private_key_len(const EVP_HPKE_KEM *kem);
69 
70 // EVP_HPKE_MAX_ENC_LENGTH is the maximum length of "enc", the encapsulated
71 // shared secret, for all KEMs currently supported by this library.
72 #define EVP_HPKE_MAX_ENC_LENGTH 32
73 
74 // EVP_HPKE_KEM_enc_len returns the length of the "enc", the encapsulated shared
75 // secret, for |kem|. This value will be at most |EVP_HPKE_MAX_ENC_LENGTH|.
76 OPENSSL_EXPORT size_t EVP_HPKE_KEM_enc_len(const EVP_HPKE_KEM *kem);
77 
78 // The following constants are KDF identifiers.
79 #define EVP_HPKE_HKDF_SHA256 0x0001
80 
81 // The following functions are KDF algorithms which may be used with HPKE.
82 OPENSSL_EXPORT const EVP_HPKE_KDF *EVP_hpke_hkdf_sha256(void);
83 
84 // EVP_HPKE_KDF_id returns the HPKE KDF identifier for |kdf|.
85 OPENSSL_EXPORT uint16_t EVP_HPKE_KDF_id(const EVP_HPKE_KDF *kdf);
86 
87 // EVP_HPKE_KDF_hkdf_md returns the HKDF hash function corresponding to |kdf|,
88 // or NULL if |kdf| is not an HKDF-based KDF. All currently supported KDFs are
89 // HKDF-based.
90 OPENSSL_EXPORT const EVP_MD *EVP_HPKE_KDF_hkdf_md(const EVP_HPKE_KDF *kdf);
91 
92 // The following constants are AEAD identifiers.
93 #define EVP_HPKE_AES_128_GCM 0x0001
94 #define EVP_HPKE_AES_256_GCM 0x0002
95 #define EVP_HPKE_CHACHA20_POLY1305 0x0003
96 
97 // The following functions are AEAD algorithms which may be used with HPKE.
98 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_hpke_aes_128_gcm(void);
99 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_hpke_aes_256_gcm(void);
100 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_hpke_chacha20_poly1305(void);
101 
102 // EVP_HPKE_AEAD_id returns the HPKE AEAD identifier for |aead|.
103 OPENSSL_EXPORT uint16_t EVP_HPKE_AEAD_id(const EVP_HPKE_AEAD *aead);
104 
105 // EVP_HPKE_AEAD_aead returns the |EVP_AEAD| corresponding to |aead|.
106 OPENSSL_EXPORT const EVP_AEAD *EVP_HPKE_AEAD_aead(const EVP_HPKE_AEAD *aead);
107 
108 
109 // Recipient keys.
110 //
111 // An HPKE recipient maintains a long-term KEM key. This library represents keys
112 // with the |EVP_HPKE_KEY| type.
113 
114 // EVP_HPKE_KEY_zero sets an uninitialized |EVP_HPKE_KEY| to the zero state. The
115 // caller should then use |EVP_HPKE_KEY_init|, |EVP_HPKE_KEY_copy|, or
116 // |EVP_HPKE_KEY_generate| to finish initializing |key|.
117 //
118 // It is safe, but not necessary to call |EVP_HPKE_KEY_cleanup| in this state.
119 // This may be used for more uniform cleanup of |EVP_HPKE_KEY|.
120 OPENSSL_EXPORT void EVP_HPKE_KEY_zero(EVP_HPKE_KEY *key);
121 
122 // EVP_HPKE_KEY_cleanup releases memory referenced by |key|.
123 OPENSSL_EXPORT void EVP_HPKE_KEY_cleanup(EVP_HPKE_KEY *key);
124 
125 // EVP_HPKE_KEY_new returns a newly-allocated |EVP_HPKE_KEY|, or NULL on error.
126 // The caller must call |EVP_HPKE_KEY_free| on the result to release it.
127 //
128 // This is a convenience function for callers that need a heap-allocated
129 // |EVP_HPKE_KEY|.
130 OPENSSL_EXPORT EVP_HPKE_KEY *EVP_HPKE_KEY_new(void);
131 
132 // EVP_HPKE_KEY_free releases memory associated with |key|, which must have been
133 // created with |EVP_HPKE_KEY_new|.
134 OPENSSL_EXPORT void EVP_HPKE_KEY_free(EVP_HPKE_KEY *key);
135 
136 // EVP_HPKE_KEY_copy sets |dst| to a copy of |src|. It returns one on success
137 // and zero on error. On success, the caller must call |EVP_HPKE_KEY_cleanup| to
138 // release |dst|. On failure, calling |EVP_HPKE_KEY_cleanup| is safe, but not
139 // necessary.
140 OPENSSL_EXPORT int EVP_HPKE_KEY_copy(EVP_HPKE_KEY *dst,
141                                      const EVP_HPKE_KEY *src);
142 
143 // EVP_HPKE_KEY_move sets |out|, which must be initialized or in the zero state,
144 // to the key in |in|. |in| is mutated and left in the zero state.
145 OPENSSL_EXPORT void EVP_HPKE_KEY_move(EVP_HPKE_KEY *out, EVP_HPKE_KEY *in);
146 
147 // EVP_HPKE_KEY_init decodes |priv_key| as a private key for |kem| and
148 // initializes |key| with the result. It returns one on success and zero if
149 // |priv_key| was invalid. On success, the caller must call
150 // |EVP_HPKE_KEY_cleanup| to release the key. On failure, calling
151 // |EVP_HPKE_KEY_cleanup| is safe, but not necessary.
152 OPENSSL_EXPORT int EVP_HPKE_KEY_init(EVP_HPKE_KEY *key, const EVP_HPKE_KEM *kem,
153                                      const uint8_t *priv_key,
154                                      size_t priv_key_len);
155 
156 // EVP_HPKE_KEY_generate sets |key| to a newly-generated key using |kem|.
157 OPENSSL_EXPORT int EVP_HPKE_KEY_generate(EVP_HPKE_KEY *key,
158                                          const EVP_HPKE_KEM *kem);
159 
160 // EVP_HPKE_KEY_kem returns the HPKE KEM used by |key|.
161 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_HPKE_KEY_kem(const EVP_HPKE_KEY *key);
162 
163 // EVP_HPKE_KEY_public_key writes |key|'s public key to |out| and sets
164 // |*out_len| to the number of bytes written. On success, it returns one and
165 // writes at most |max_out| bytes. If |max_out| is too small, it returns zero.
166 // Setting |max_out| to |EVP_HPKE_MAX_PUBLIC_KEY_LENGTH| will ensure the public
167 // key fits. An exact size can also be determined by
168 // |EVP_HPKE_KEM_public_key_len|.
169 OPENSSL_EXPORT int EVP_HPKE_KEY_public_key(const EVP_HPKE_KEY *key,
170                                            uint8_t *out, size_t *out_len,
171                                            size_t max_out);
172 
173 // EVP_HPKE_KEY_private_key writes |key|'s private key to |out| and sets
174 // |*out_len| to the number of bytes written. On success, it returns one and
175 // writes at most |max_out| bytes. If |max_out| is too small, it returns zero.
176 // Setting |max_out| to |EVP_HPKE_MAX_PRIVATE_KEY_LENGTH| will ensure the
177 // private key fits. An exact size can also be determined by
178 // |EVP_HPKE_KEM_private_key_len|.
179 OPENSSL_EXPORT int EVP_HPKE_KEY_private_key(const EVP_HPKE_KEY *key,
180                                             uint8_t *out, size_t *out_len,
181                                             size_t max_out);
182 
183 
184 // Encryption contexts.
185 //
186 // An HPKE encryption context is represented by the |EVP_HPKE_CTX| type.
187 
188 // EVP_HPKE_CTX_zero sets an uninitialized |EVP_HPKE_CTX| to the zero state. The
189 // caller should then use one of the |EVP_HPKE_CTX_setup_*| functions to finish
190 // setting up |ctx|.
191 //
192 // It is safe, but not necessary to call |EVP_HPKE_CTX_cleanup| in this state.
193 // This may be used for more uniform cleanup of |EVP_HPKE_CTX|.
194 OPENSSL_EXPORT void EVP_HPKE_CTX_zero(EVP_HPKE_CTX *ctx);
195 
196 // EVP_HPKE_CTX_cleanup releases memory referenced by |ctx|. |ctx| must have
197 // been initialized with |EVP_HPKE_CTX_zero| or one of the
198 // |EVP_HPKE_CTX_setup_*| functions.
199 OPENSSL_EXPORT void EVP_HPKE_CTX_cleanup(EVP_HPKE_CTX *ctx);
200 
201 // EVP_HPKE_CTX_new returns a newly-allocated |EVP_HPKE_CTX|, or NULL on error.
202 // The caller must call |EVP_HPKE_CTX_free| on the result to release it.
203 //
204 // This is a convenience function for callers that need a heap-allocated
205 // |EVP_HPKE_CTX|.
206 OPENSSL_EXPORT EVP_HPKE_CTX *EVP_HPKE_CTX_new(void);
207 
208 // EVP_HPKE_CTX_free releases memory associated with |ctx|, which must have been
209 // created with |EVP_HPKE_CTX_new|.
210 OPENSSL_EXPORT void EVP_HPKE_CTX_free(EVP_HPKE_CTX *ctx);
211 
212 // EVP_HPKE_CTX_setup_sender implements the SetupBaseS HPKE operation. It
213 // encapsulates a shared secret for |peer_public_key| and sets up |ctx| as a
214 // sender context. It writes the encapsulated shared secret to |out_enc| and
215 // sets |*out_enc_len| to the number of bytes written. It writes at most
216 // |max_enc| bytes and fails if the buffer is too small. Setting |max_enc| to at
217 // least |EVP_HPKE_MAX_ENC_LENGTH| will ensure the buffer is large enough. An
218 // exact size may also be determined by |EVP_PKEY_KEM_enc_len|.
219 //
220 // This function returns one on success and zero on error. Note that
221 // |peer_public_key| may be invalid, in which case this function will return an
222 // error.
223 //
224 // On success, callers may call |EVP_HPKE_CTX_seal| to encrypt messages for the
225 // recipient. Callers must then call |EVP_HPKE_CTX_cleanup| when done. On
226 // failure, calling |EVP_HPKE_CTX_cleanup| is safe, but not required.
227 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_sender(
228     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
229     const EVP_HPKE_KEM *kem, const EVP_HPKE_KDF *kdf, const EVP_HPKE_AEAD *aead,
230     const uint8_t *peer_public_key, size_t peer_public_key_len,
231     const uint8_t *info, size_t info_len);
232 
233 // EVP_HPKE_CTX_setup_sender_with_seed_for_testing behaves like
234 // |EVP_HPKE_CTX_setup_sender|, but takes a seed to behave deterministically.
235 // The seed's format depends on |kem|. For X25519, it is the sender's
236 // ephemeral private key.
237 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_sender_with_seed_for_testing(
238     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
239     const EVP_HPKE_KEM *kem, const EVP_HPKE_KDF *kdf, const EVP_HPKE_AEAD *aead,
240     const uint8_t *peer_public_key, size_t peer_public_key_len,
241     const uint8_t *info, size_t info_len, const uint8_t *seed, size_t seed_len);
242 
243 // EVP_HPKE_CTX_setup_recipient implements the SetupBaseR HPKE operation. It
244 // decapsulates the shared secret in |enc| with |key| and sets up |ctx| as a
245 // recipient context. It returns one on success and zero on failure. Note that
246 // |enc| may be invalid, in which case this function will return an error.
247 //
248 // On success, callers may call |EVP_HPKE_CTX_open| to decrypt messages from the
249 // sender. Callers must then call |EVP_HPKE_CTX_cleanup| when done. On failure,
250 // calling |EVP_HPKE_CTX_cleanup| is safe, but not required.
251 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_recipient(
252     EVP_HPKE_CTX *ctx, const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf,
253     const EVP_HPKE_AEAD *aead, const uint8_t *enc, size_t enc_len,
254     const uint8_t *info, size_t info_len);
255 
256 // EVP_HPKE_CTX_setup_auth_sender implements the SetupAuthS HPKE operation. It
257 // behaves like |EVP_HPKE_CTX_setup_sender| but authenticates the resulting
258 // context with |key|.
259 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_sender(
260     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
261     const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf, const EVP_HPKE_AEAD *aead,
262     const uint8_t *peer_public_key, size_t peer_public_key_len,
263     const uint8_t *info, size_t info_len);
264 
265 // EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing behaves like
266 // |EVP_HPKE_CTX_setup_auth_sender|, but takes a seed to behave
267 // deterministically. The seed's format depends on |kem|. For X25519, it is the
268 // sender's ephemeral private key.
269 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_sender_with_seed_for_testing(
270     EVP_HPKE_CTX *ctx, uint8_t *out_enc, size_t *out_enc_len, size_t max_enc,
271     const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf, const EVP_HPKE_AEAD *aead,
272     const uint8_t *peer_public_key, size_t peer_public_key_len,
273     const uint8_t *info, size_t info_len, const uint8_t *seed, size_t seed_len);
274 
275 // EVP_HPKE_CTX_setup_auth_recipient implements the SetupAuthR HPKE operation.
276 // It behaves like |EVP_HPKE_CTX_setup_recipient| but checks the resulting
277 // context was authenticated with |peer_public_key|.
278 OPENSSL_EXPORT int EVP_HPKE_CTX_setup_auth_recipient(
279     EVP_HPKE_CTX *ctx, const EVP_HPKE_KEY *key, const EVP_HPKE_KDF *kdf,
280     const EVP_HPKE_AEAD *aead, const uint8_t *enc, size_t enc_len,
281     const uint8_t *info, size_t info_len, const uint8_t *peer_public_key,
282     size_t peer_public_key_len);
283 
284 
285 // Using an HPKE context.
286 //
287 // Once set up, callers may encrypt or decrypt with an |EVP_HPKE_CTX| using the
288 // following functions.
289 
290 // EVP_HPKE_CTX_open uses the HPKE context |ctx| to authenticate |in_len| bytes
291 // from |in| and |ad_len| bytes from |ad| and to decrypt at most |in_len| bytes
292 // into |out|. It returns one on success, and zero otherwise.
293 //
294 // This operation will fail if the |ctx| context is not set up as a receiver.
295 //
296 // Note that HPKE encryption is stateful and ordered. The sender's first call to
297 // |EVP_HPKE_CTX_seal| must correspond to the recipient's first call to
298 // |EVP_HPKE_CTX_open|, etc.
299 //
300 // At most |in_len| bytes are written to |out|. In order to ensure success,
301 // |max_out_len| should be at least |in_len|. On successful return, |*out_len|
302 // is set to the actual number of bytes written.
303 OPENSSL_EXPORT int EVP_HPKE_CTX_open(EVP_HPKE_CTX *ctx, uint8_t *out,
304                                      size_t *out_len, size_t max_out_len,
305                                      const uint8_t *in, size_t in_len,
306                                      const uint8_t *ad, size_t ad_len);
307 
308 // EVP_HPKE_CTX_seal uses the HPKE context |ctx| to encrypt and authenticate
309 // |in_len| bytes of ciphertext |in| and authenticate |ad_len| bytes from |ad|,
310 // writing the result to |out|. It returns one on success and zero otherwise.
311 //
312 // This operation will fail if the |ctx| context is not set up as a sender.
313 //
314 // Note that HPKE encryption is stateful and ordered. The sender's first call to
315 // |EVP_HPKE_CTX_seal| must correspond to the recipient's first call to
316 // |EVP_HPKE_CTX_open|, etc.
317 //
318 // At most, |max_out_len| encrypted bytes are written to |out|. On successful
319 // return, |*out_len| is set to the actual number of bytes written.
320 //
321 // To ensure success, |max_out_len| should be |in_len| plus the result of
322 // |EVP_HPKE_CTX_max_overhead| or |EVP_HPKE_MAX_OVERHEAD|.
323 OPENSSL_EXPORT int EVP_HPKE_CTX_seal(EVP_HPKE_CTX *ctx, uint8_t *out,
324                                      size_t *out_len, size_t max_out_len,
325                                      const uint8_t *in, size_t in_len,
326                                      const uint8_t *ad, size_t ad_len);
327 
328 // EVP_HPKE_CTX_export uses the HPKE context |ctx| to export a secret of
329 // |secret_len| bytes into |out|. This function uses |context_len| bytes from
330 // |context| as a context string for the secret. This is necessary to separate
331 // different uses of exported secrets and bind relevant caller-specific context
332 // into the output. It returns one on success and zero otherwise.
333 OPENSSL_EXPORT int EVP_HPKE_CTX_export(const EVP_HPKE_CTX *ctx, uint8_t *out,
334                                        size_t secret_len,
335                                        const uint8_t *context,
336                                        size_t context_len);
337 
338 // EVP_HPKE_MAX_OVERHEAD contains the largest value that
339 // |EVP_HPKE_CTX_max_overhead| would ever return for any context.
340 #define EVP_HPKE_MAX_OVERHEAD EVP_AEAD_MAX_OVERHEAD
341 
342 // EVP_HPKE_CTX_max_overhead returns the maximum number of additional bytes
343 // added by sealing data with |EVP_HPKE_CTX_seal|. The |ctx| context must be set
344 // up as a sender.
345 OPENSSL_EXPORT size_t EVP_HPKE_CTX_max_overhead(const EVP_HPKE_CTX *ctx);
346 
347 // EVP_HPKE_CTX_kem returns |ctx|'s configured KEM, or NULL if the context has
348 // not been set up.
349 OPENSSL_EXPORT const EVP_HPKE_KEM *EVP_HPKE_CTX_kem(const EVP_HPKE_CTX *ctx);
350 
351 // EVP_HPKE_CTX_aead returns |ctx|'s configured AEAD, or NULL if the context has
352 // not been set up.
353 OPENSSL_EXPORT const EVP_HPKE_AEAD *EVP_HPKE_CTX_aead(const EVP_HPKE_CTX *ctx);
354 
355 // EVP_HPKE_CTX_kdf returns |ctx|'s configured KDF, or NULL if the context has
356 // not been set up.
357 OPENSSL_EXPORT const EVP_HPKE_KDF *EVP_HPKE_CTX_kdf(const EVP_HPKE_CTX *ctx);
358 
359 
360 // Private structures.
361 //
362 // The following structures are exported so their types are stack-allocatable,
363 // but accessing or modifying their fields is forbidden.
364 
365 struct evp_hpke_ctx_st {
366   const EVP_HPKE_KEM *kem;
367   const EVP_HPKE_AEAD *aead;
368   const EVP_HPKE_KDF *kdf;
369   EVP_AEAD_CTX aead_ctx;
370   uint8_t base_nonce[EVP_AEAD_MAX_NONCE_LENGTH];
371   uint8_t exporter_secret[EVP_MAX_MD_SIZE];
372   uint64_t seq;
373   int is_sender;
374 };
375 
376 struct evp_hpke_key_st {
377   const EVP_HPKE_KEM *kem;
378   uint8_t private_key[X25519_PRIVATE_KEY_LEN];
379   uint8_t public_key[X25519_PUBLIC_VALUE_LEN];
380 };
381 
382 
383 #if defined(__cplusplus)
384 }  // extern C
385 #endif
386 
387 #if !defined(BORINGSSL_NO_CXX)
388 extern "C++" {
389 
390 BSSL_NAMESPACE_BEGIN
391 
392 using ScopedEVP_HPKE_CTX =
393     internal::StackAllocated<EVP_HPKE_CTX, void, EVP_HPKE_CTX_zero,
394                              EVP_HPKE_CTX_cleanup>;
395 using ScopedEVP_HPKE_KEY =
396     internal::StackAllocatedMovable<EVP_HPKE_KEY, void, EVP_HPKE_KEY_zero,
397                                     EVP_HPKE_KEY_cleanup, EVP_HPKE_KEY_move>;
398 
399 BORINGSSL_MAKE_DELETER(EVP_HPKE_CTX, EVP_HPKE_CTX_free)
400 BORINGSSL_MAKE_DELETER(EVP_HPKE_KEY, EVP_HPKE_KEY_free)
401 
402 BSSL_NAMESPACE_END
403 
404 }  // extern C++
405 #endif
406 
407 #endif  // OPENSSL_HEADER_CRYPTO_HPKE_INTERNAL_H
408