Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Methods](https://developer.android.com/reference/android/crypto/hpke/Hpke#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/android/crypto/hpke/Hpke#inhmethods)

# Hpke

*** ** * ** ***


`
public


class
Hpke
`


`

extends https://developer.android.com/reference/java/lang/Object


`

`


`

|---|---|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | android.crypto.hpke.Hpke |

<br />

*** ** * ** ***

Provides access to implementations of HPKE hybrid cryptography as per RFC 9180.


Provider and HPKE suite selection are done via the `getInstance`
methods, and then instances of senders and receivers can be created using
`newSender` or {newReceiver}. Each sender and receiver is independent, i.e. does
not share any encapsulated state with other senders or receivers created via this
`Hpke`.


HPKE suites are composed of a key encapsulation mechanism (KEM), a key derivation
function (KDF) and an authenticated cipher algorithm (AEAD) as defined in
RFC 9180 section 7. `https://developer.android.com/reference/java/security/spec/NamedParameterSpec` for
these can be found in `https://developer.android.com/reference/android/crypto/hpke/KemParameterSpec`, `https://developer.android.com/reference/android/crypto/hpke/KdfParameterSpec` and
`https://developer.android.com/reference/android/crypto/hpke/AeadParameterSpec`. These can be composed into a full HPKE suite name used to
request a particular implementation using
`https://developer.android.com/reference/android/crypto/hpke/Hpke#getSuiteName(android.crypto.hpke.KemParameterSpec,%20android.crypto.hpke.KdfParameterSpec,%20android.crypto.hpke.AeadParameterSpec)`.
**See also:**

- `https://developer.android.com/reference/android/crypto/hpke/KemParameterSpec`
- `https://developer.android.com/reference/android/crypto/hpke/KdfParameterSpec`
- `https://developer.android.com/reference/android/crypto/hpke/AeadParameterSpec`

## Summary

| ### Public methods ||
|---|---|
| ` static https://developer.android.com/reference/android/crypto/hpke/Hpke` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#getInstance(java.lang.String)(https://developer.android.com/reference/java/lang/String suiteName) ` Returns an Hpke instance configured for the requested HPKE suite, using the highest priority `https://developer.android.com/reference/java/security/Provider` which implements it. |
| ` static https://developer.android.com/reference/android/crypto/hpke/Hpke` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#getInstance(java.lang.String,%20java.lang.String)(https://developer.android.com/reference/java/lang/String suiteName, https://developer.android.com/reference/java/lang/String providerName) ` Returns an Hpke instance configured for the requested HPKE suite, using the requested `https://developer.android.com/reference/java/security/Provider` by name. |
| ` static https://developer.android.com/reference/android/crypto/hpke/Hpke` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#getInstance(java.lang.String,%20java.security.Provider)(https://developer.android.com/reference/java/lang/String suiteName, https://developer.android.com/reference/java/security/Provider provider) ` Returns an Hpke instance configured for the requested HPKE suite, using the requested `https://developer.android.com/reference/java/security/Provider`. |
| ` https://developer.android.com/reference/java/security/Provider` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#getProvider()() ` Returns the `https://developer.android.com/reference/java/security/Provider` being used by this Hpke instance. |
| ` static https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#getSuiteName(android.crypto.hpke.KemParameterSpec,%20android.crypto.hpke.KdfParameterSpec,%20android.crypto.hpke.AeadParameterSpec)(https://developer.android.com/reference/android/crypto/hpke/KemParameterSpec kem, https://developer.android.com/reference/android/crypto/hpke/KdfParameterSpec kdf, https://developer.android.com/reference/android/crypto/hpke/AeadParameterSpec aead) ` Generates a full HPKE suite name from the named parameter specifications of its components, which have names reflecting their usage in RFC 9180. |
| ` byte[]` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#open(java.security.PrivateKey,%20byte[],%20android.crypto.hpke.Message,%20byte[])(https://developer.android.com/reference/java/security/PrivateKey recipientKey, byte[] info, https://developer.android.com/reference/android/crypto/hpke/Message message, byte[] aad) ` One shot API to open a single ciphertext using BASE mode (no authentication). |
| ` https://developer.android.com/reference/android/crypto/hpke/Message` | ` https://developer.android.com/reference/android/crypto/hpke/Hpke#seal(java.security.PublicKey,%20byte[],%20byte[],%20byte[])(https://developer.android.com/reference/java/security/PublicKey recipientKey, byte[] info, byte[] plaintext, byte[] aad) ` One shot API to seal a single message using BASE mode (no authentication). |

| ### Inherited methods |
|---|---|
| From class ` https://developer.android.com/reference/java/lang/Object ` |---|---| | ` https://developer.android.com/reference/java/lang/Object` | ` https://developer.android.com/reference/java/lang/Object#clone()() ` Creates and returns a copy of this object. | | ` boolean` | ` https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj) ` Indicates whether some other object is "equal to" this one. | | ` void` | ` https://developer.android.com/reference/java/lang/Object#finalize()() ` Called by the garbage collector on an object when garbage collection determines that there are no more references to the object. | | ` final https://developer.android.com/reference/java/lang/Class<?>` | ` https://developer.android.com/reference/java/lang/Object#getClass()() ` Returns the runtime class of this `Object`. | | ` int` | ` https://developer.android.com/reference/java/lang/Object#hashCode()() ` Returns a hash code value for the object. | | ` final void` | ` https://developer.android.com/reference/java/lang/Object#notify()() ` Wakes up a single thread that is waiting on this object's monitor. | | ` final void` | ` https://developer.android.com/reference/java/lang/Object#notifyAll()() ` Wakes up all threads that are waiting on this object's monitor. | | ` https://developer.android.com/reference/java/lang/String` | ` https://developer.android.com/reference/java/lang/Object#toString()() ` Returns a string representation of the object. | | ` final void` | ` https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos) ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed. | | ` final void` | ` https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis) ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed. | | ` final void` | ` https://developer.android.com/reference/java/lang/Object#wait()() ` Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*. | ||

## Public methods

### getInstance

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static Hpke getInstance (String suiteName)
```

Returns an Hpke instance configured for the requested HPKE suite, using the
highest priority `https://developer.android.com/reference/java/security/Provider` which implements it.


Use `https://developer.android.com/reference/android/crypto/hpke/Hpke#getSuiteName(android.crypto.hpke.KemParameterSpec,%20android.crypto.hpke.KdfParameterSpec,%20android.crypto.hpke.AeadParameterSpec)` for
generating HPKE suite names from `https://developer.android.com/reference/java/security/spec/NamedParameterSpec`

<br />

| Parameters ||
|---|---|
| `suiteName` | `String`: the HPKE suite to use. This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/android/crypto/hpke/Hpke` | an Hpke instance configured for the requested suite. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/security/NoSuchAlgorithmException` | if no Providers can be found for the requested suite |

### getInstance

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static Hpke getInstance (String suiteName, 
                String providerName)
```

Returns an Hpke instance configured for the requested HPKE suite, using the
requested `https://developer.android.com/reference/java/security/Provider` by name.

<br />

| Parameters ||
|---|---|
| `suiteName` | `String`: the HPKE suite to use. This value cannot be `null`. <br /> |
| `providerName` | `String`: the name of the provider to use. This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/android/crypto/hpke/Hpke` | an Hpke instance configured for the requested suite and Provider. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/lang/IllegalArgumentException` | if providerName is null or empty |
| `https://developer.android.com/reference/java/security/NoSuchAlgorithmException` | if the named Provider does not implement this suite |
| `https://developer.android.com/reference/java/security/NoSuchProviderException` | if no Provider with the requested name can be found |

### getInstance

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static Hpke getInstance (String suiteName, 
                Provider provider)
```

Returns an Hpke instance configured for the requested HPKE suite, using the
requested `https://developer.android.com/reference/java/security/Provider`.

<br />

| Parameters ||
|---|---|
| `suiteName` | `String`: the HPKE suite to use. This value cannot be `null`. <br /> |
| `provider` | `Provider`: the provider to use. This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/android/crypto/hpke/Hpke` | an Hpke instance configured for the requested suite and Provider. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/lang/IllegalArgumentException` | if provider is null |
| `https://developer.android.com/reference/java/security/NoSuchAlgorithmException` | if the Provider does not implement this suite |
| `https://developer.android.com/reference/java/security/NoSuchProviderException` |   |

### getProvider

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Provider getProvider ()
```

Returns the `https://developer.android.com/reference/java/security/Provider` being used by this Hpke instance.

<br />

<br />

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/security/Provider` | the Provider. This value cannot be `null`. <br /> |

### getSuiteName

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static String getSuiteName (KemParameterSpec kem, 
                KdfParameterSpec kdf, 
                AeadParameterSpec aead)
```

Generates a full HPKE suite name from the named parameter specifications of its components,
which have names reflecting their usage in RFC 9180.


HPKE suites are composed of a key encapsulation mechanism (KEM), a key derivation
function (KDF) and an authenticated cipher algorithm (AEAD) as defined in
RFC 9180 section 7. `https://developer.android.com/reference/java/security/spec/NamedParameterSpec` for
these can be foundu in `https://developer.android.com/reference/android/crypto/hpke/KemParameterSpec`, `https://developer.android.com/reference/android/crypto/hpke/KdfParameterSpec` and
`https://developer.android.com/reference/android/crypto/hpke/AeadParameterSpec`.

<br />

| Parameters ||
|---|---|
| `kem` | `KemParameterSpec`: the key encapsulation mechanism to use. This value cannot be `null`. <br /> |
| `kdf` | `KdfParameterSpec`: the key derivation function to use. This value cannot be `null`. <br /> |
| `aead` | `AeadParameterSpec`: the AEAD cipher to use. This value cannot be `null`. <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/lang/String` | a fully composed HPKE suite name. This value cannot be `null`. <br /> |

**See also:**

- `https://developer.android.com/reference/android/crypto/hpke/KemParameterSpec`
- `https://developer.android.com/reference/android/crypto/hpke/KdfParameterSpec`
- `https://developer.android.com/reference/android/crypto/hpke/AeadParameterSpec`
- [RFC 9180 Section 7](https://www.rfc-editor.org/rfc/rfc9180.html#section-7)

### open

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public byte[] open (PrivateKey recipientKey, 
                byte[] info, 
                Message message, 
                byte[] aad)
```

One shot API to open a single ciphertext using BASE mode (no authentication).

<br />

| Parameters ||
|---|---|
| `recipientKey` | `PrivateKey`: private key of the recipient. This value cannot be `null`. <br /> |
| `info` | `byte`: application-supplied information, may be null or empty <br /> |
| `message` | `Message`: the Message to open. This value cannot be `null`. <br /> |
| `aad` | `byte`: optional additional authenticated data, may be null or empty <br /> |

| Returns ||
|---|---|
| `byte[]` | decrypted plaintext. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/security/GeneralSecurityException` | if the decryption fails |
| `https://developer.android.com/reference/java/security/InvalidKeyException` | if recipientKey is null or an unsupported key format |

**See also:**

- [Opening and sealing](https://www.rfc-editor.org/rfc/rfc9180.html#name-encryption-and-decryption-2)

### seal

Added in [API level 37](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Message seal (PublicKey recipientKey, 
                byte[] info, 
                byte[] plaintext, 
                byte[] aad)
```

One shot API to seal a single message using BASE mode (no authentication).

<br />

| Parameters ||
|---|---|
| `recipientKey` | `PublicKey`: public key of the recipient. This value cannot be `null`. <br /> |
| `info` | `byte`: additional application-supplied information, may be null or empty <br /> |
| `plaintext` | `byte`: the message to send. This value cannot be `null`. <br /> |
| `aad` | `byte`: optional additional authenticated data, may be null or empty <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/android/crypto/hpke/Message` | a Message object containing the encapsulated key, ciphertext and aad. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/java/security/InvalidKeyException` | if recipientKey is null or an unsupported key format |

**See also:**

- [Opening and sealing](https://www.rfc-editor.org/rfc/rfc9180.html#name-encryption-and-decryption-2)