celabshq · jschneider-bensch · Jul 9, 2026 · Nov 19, 2023 · Nov 20, 2023 · Nov 20, 2023
diff --git a/.github/workflows/hpke-benches.yml b/.github/workflows/hpke-benches.yml
@@ -0,0 +1,36 @@
+name: HPKE - Benchmarks
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches: [ main ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+defaults:
+  run:
+    working-directory: ./crates/protocols/hpke
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macos-15-intel
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/checkout@v7
+    - name: HPKE Benchmarks
+      run: cargo bench manual_benches
+    - name: HPKE Rust Crypto Benchmarks
+      working-directory: ./crates/protocols/hpke/rust_crypto_provider
+      run: cargo bench
diff --git a/.github/workflows/hpke-coverage.yml.disabled b/.github/workflows/hpke-coverage.yml.disabled
@@ -0,0 +1,41 @@
+name: HPKE - test coverage
+
+on: [push]
+
+defaults:
+  run:
+    working-directory: ./crates/protocols/hpke
+
+jobs:
+  check:
+    name: coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rustc, rust-std, cargo, llvm-tools, llvm-tools-preview
+      - uses: baptiste0928/cargo-install@v3
+        with:
+          crate: grcov
+      - uses: Swatinem/rust-cache@v2
+      - name: Run profiling tests
+        run: |
+          mkdir -p target/debug/coverage
+          cargo test --no-fail-fast
+        env:
+          CARGO_INCREMENTAL: '0'
+          RUSTFLAGS: '-Cinstrument-coverage -Ccodegen-units=1 -Cllvm-args=--inline-threshold=0 -Clink-dead-code -Coverflow-checks=off -Cpanic=abort -Zpanic_abort_tests'
+          RUSTDOCFLAGS: '-Cinstrument-coverage -Ccodegen-units=1 -Cllvm-args=--inline-threshold=0 -Clink-dead-code -Coverflow-checks=off -Cpanic=abort -Zpanic_abort_tests -Z unstable-options --persist-doctests target/debug'
+
+      - name: Run grcov
+        id: coverage
+        run: grcov . -s . --binary-path ./target/debug/ -t lcov --branch --ignore-not-existing -o ./target/debug/coverage/
+
+      - name: Upload to codecov.io
+        uses: codecov/codecov-action@v7
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: target/debug/coverage/lcov
diff --git a/.github/workflows/hpke-gh-pages.yml.disabled b/.github/workflows/hpke-gh-pages.yml.disabled
@@ -0,0 +1,32 @@
+name: HPKE - Deploy Docs
+
+on:
+  push:
+    branches:
+      - main
+
+defaults:
+  run:
+    working-directory: ./crates/protocols/hpke
+
+jobs:
+  rustdoc:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: hecrj/setup-rust-action@master
+      - uses: actions/checkout@master
+      - name: Build docs
+        run: |
+          cargo doc -F "std,serialization,hazmat,rustcrypto,libcrux" --no-deps
+          touch ../../../target/doc/hpke_rs/.nojekyll
+          cat > ../../../target/doc/hpke_rs/index.html <<EOF
+          <!doctype html>
+          <html><head>
+            <meta http-equiv="refresh" content="0; URL='hpke_rs/index.html'" />
+          </head></html>
+          EOF
+      - name: Deploy to Github Pages
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ../../../target/doc/hpke_rs
diff --git a/.github/workflows/hpke-ios.yml b/.github/workflows/hpke-ios.yml
@@ -0,0 +1,34 @@
+name: HPKE - iOS
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches: [ main ]
+
+env:
+  CARGO_TERM_COLOR: always
+
+defaults:
+  run:
+    working-directory: ./crates/protocols/hpke
+
+jobs:
+  build:
+    runs-on: macos-15-intel
+
+    steps:
+    - uses: actions/checkout@v7
+    - name: Setup MacOS
+      run: |
+        rustup target install aarch64-apple-darwin
+        rustup target install aarch64-apple-ios
+    - name: Apple Silicon Build
+      run: |
+        cargo build --target aarch64-apple-darwin --tests --verbose
+        cargo build --release --target aarch64-apple-darwin --tests --verbose
+    - name: iOS build
+      run: |
+        cargo build --target aarch64-apple-ios --tests --verbose
+        cargo build --release --target aarch64-apple-ios --tests --verbose
diff --git a/.github/workflows/hpke-rust.yml b/.github/workflows/hpke-rust.yml
@@ -0,0 +1,136 @@
+name: HPKE - Build & Test
+
+on:
+  push:
+    branches:
+      - '*'
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+defaults:
+  run:
+    working-directory: ./crates/protocols/hpke
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macos-15-intel
+          - macos-latest
+          - ubuntu-latest
+          - windows-latest
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+      with:
+        persist-credentials: false
+    - name: Run tests all features
+      run: cargo test --verbose --no-default-features -F "std,serialization,hazmat,rustcrypto,libcrux,experimental"
+      # Release
+    - name: Build Release
+      run: cargo build --release --verbose
+    - name: Run tests all features
+      run: cargo test --release --verbose -F "std,serialization,hazmat,rustcrypto,libcrux"
+      # Debug
+    - name: Build Debug
+      run: cargo build --verbose
+    - name: Run tests all features
+      run: cargo test --verbose -F "std,serialization,hazmat,rustcrypto,libcrux"
+      # RC Provider
+    - name: Build Debug RC provider all features
+      working-directory: ./crates/protocols/hpke/rust_crypto_provider
+      run: cargo build --verbose -F "std"
+    # Apple Silicon
+    - if: matrix.os == 'macos-15-intel'
+      run: |
+        rustup target install aarch64-apple-darwin
+        rustup target install aarch64-apple-ios
+    - name: Build
+      run: cargo build --verbose
+    - name: Apple Silicon Build
+      if: matrix.os == 'macos-15-intel'
+      run: |
+        cargo build --target aarch64-apple-darwin --tests --verbose
+        cargo build --release --target aarch64-apple-darwin --tests --verbose
+    # ARM64 iOS
+    - name: iOS aarch64
+      if: matrix.os == 'macos-15-intel'
+      run: |
+        cargo build --target aarch64-apple-ios --tests --verbose
+        cargo build --release --target aarch64-apple-ios --tests --verbose
+  cross-build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          # 32-bit Linux
+          - target: i686-unknown-linux-gnu
+            rust: stable
+            deps: sudo apt update && sudo apt install gcc-multilib
+          # wasm
+          - target: wasm32-unknown-unknown
+            rust: stable
+          # ARM64 Android
+          - target: aarch64-linux-android
+            rust: stable
+          # ARM64 iOS
+          - target: aarch64-apple-ios
+            rust: stable
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: ${{ matrix.rust }}
+          target: ${{ matrix.target }}
+      - run: ${{ matrix.deps }}
+      - run: cargo build --target ${{ matrix.target }}
+      - run: cargo build --target ${{ matrix.target }} --release
+
+  fuzz:
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - macos-15-intel
+          - ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+        with:
+          persist-credentials: false
+      - name: Install latest nightly
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: nightly
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz
+      - name: Fuzz Base w/ RustCrypto
+        run: cargo fuzz run base -- -runs=10000
+
+  no-std-check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+        with:
+          persist-credentials: false
+      # we use a target that lacks a pre-compiled libstd to check if any dependency is using libstd
+      - name: Install stable toolchain
+        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        with:
+          toolchain: stable
+          targets: thumbv7em-none-eabihf
+      - name: build crates in no-std mode
+        run: cargo check --target thumbv7em-none-eabihf
+        working-directory: ./crates/protocols/hpke/no-std-support-check
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -16,6 +16,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- [#1505](https://github.com/cryspen/libcrux/pull/1505): Update dependency: `hpke-rs`
 - (libcrux-traits, libcrux-sha3, libcrux-sha2, libcrux-blake2) [#1493](https://github.com/cryspen/libcrux/pull/1493): `finish` methods on digest traits consume the hasher
 - (libcrux-secrets) [#1446](https://github.com/cryspen/libcrux/pull/1446): Remove const qualifier of secret types constructors
 - (libcrux-secrets) [#1462](https://github.com/cryspen/libcrux/pull/1462): More robust casts instead of transmutes when checking secret independence

diff --git a/Cargo.toml b/Cargo.toml
@@ -53,6 +53,10 @@ members = [
     "crates/algorithms/sha3",
     "crates/primitives/aead",
     "crates/primitives/digest",
+    "crates/protocols/hpke",
+    "crates/protocols/hpke/libcrux_provider",
+    "crates/protocols/hpke/rust_crypto_provider",
+    "crates/protocols/hpke/traits",
     "crates/sys/platform",
     "crates/testing/kats",
     "crates/utils/core-models",
@@ -114,14 +118,20 @@ libcrux-digest = { version = "=0.0.8", path = "crates/primitives/digest" }
 libcrux-rsa = { version = "=0.0.7", path = "crates/algorithms/rsa" }
 libcrux-sha2 = { version = "=0.0.7", path = "crates/algorithms/sha2" }
 libcrux-sha3 = { version = "=0.0.9", path = "crates/algorithms/sha3" }
-libcrux-traits = { version = "=0.0.7", path = "traits" }
-libcrux-kem = { version = "=0.0.8", path = "libcrux-kem" }
 libcrux-ml-dsa = { version = "=0.0.9", path = "libcrux-ml-dsa" }
 libcrux-platform = { version = "=0.0.3", path = "crates/sys/platform" }
 libcrux-psq = { version = "=0.0.9", path = "libcrux-psq" }
 
+# HPKE
+hpke-rs = { version = "=0.6.1", path = "crates/protocols/hpke" }
+hpke-rs-crypto = { version = "=0.6.1", path = "crates/protocols/hpke/traits", default-features = false }
+hpke-rs-rust-crypto = { version = "=0.6.1", path = "crates/protocols/hpke/rust_crypto_provider", default-features = false }
+hpke-rs-libcrux = { version = "=0.6.1", path = "crates/protocols/hpke/libcrux_provider", default-features = false }
+
 # For the crates below it is necessary to set `default-features = true`
 # in workspace crates that depend on the default feature set.
+libcrux-kem = { version = "=0.0.8", path = "libcrux-kem", default-features = false }
+libcrux-traits = { version = "=0.0.7", path = "traits", default-features = false }
 libcrux-ecdh = { version = "=0.0.7", path = "libcrux-ecdh", default-features = false }
 libcrux-curve25519 = { version = "=0.0.7", path = "crates/algorithms/curve25519", default-features = false }
 libcrux-ml-kem = { version = "=0.0.9", path = "libcrux-ml-kem", default-features = false }
@@ -207,12 +217,12 @@ getrandom = { version = "0.4", optional = true }
 hax-lib.workspace = true
 
 # External Cryspen code.
-hpke-rs = { version = "0.6", features = ["libcrux"] }
+hpke-rs = { workspace = true, features = ["libcrux"] }
 
 # Primitives
 libcrux-aead.workspace = true
 libcrux-digest.workspace = true
-libcrux-kem.workspace = true
+libcrux-kem = { workspace = true, default-features = true }
 
 # Algorithms
 libcrux-aes.workspace = true

diff --git a/benchmarks/Cargo.toml b/benchmarks/Cargo.toml
@@ -21,7 +21,7 @@ libcrux-chacha20poly1305 = { path = "../crates/algorithms/chacha20poly1305" }
 libcrux-ecdh = { path = "../libcrux-ecdh" }
 libcrux-ecdsa = { path = "../crates/algorithms/ecdsa" }
 libcrux-ed25519 = { path = "../crates/algorithms/ed25519" }
-libcrux-kem = { path = "../libcrux-kem", features = ["tests"] }
+libcrux-kem = { path = "../libcrux-kem", features = ["tests"], default-features = true }
 libcrux-ml-kem = { path = "../libcrux-ml-kem" }
 libcrux-rsa = { path = "../crates/algorithms/rsa" }
 libcrux-sha2 = { path = "../crates/algorithms/sha2" }

diff --git a/crates/algorithms/aes/Cargo.toml b/crates/algorithms/aes/Cargo.toml
@@ -16,7 +16,7 @@ bench = false # so libtest doesn't eat the arguments to criterion
 [dependencies]
 libcrux-intrinsics.workspace = true
 libcrux-platform.workspace = true
-libcrux-traits.workspace = true
+libcrux-traits = { workspace = true, default-features = true }
 libcrux-secrets.workspace = true
 
 [features]

diff --git a/crates/algorithms/aes/fuzz/Cargo.toml b/crates/algorithms/aes/fuzz/Cargo.toml
@@ -8,7 +8,7 @@ version = "0.0.0"
 cargo-fuzz = true
 
 [dependencies]
-libcrux-traits.workspace = true
+libcrux-traits = { workspace = true, default-features = true }
 libfuzzer-sys = "0.4"
 
 [dependencies.libcrux-aes]

diff --git a/crates/algorithms/blake2/Cargo.toml b/crates/algorithms/blake2/Cargo.toml
@@ -17,12 +17,12 @@ default = ["std"]
 [dependencies]
 libcrux-hacl-rs.workspace = true
 libcrux-macros.workspace = true
-libcrux-traits.workspace = true
+libcrux-traits = { workspace = true, default-features = true }
 
 [dev-dependencies]
 criterion = "0.8"
 rand = "0.10"
-libcrux-traits = { workspace = true, features = ["generic-tests"] }
+libcrux-traits = { workspace = true, default-features = true, features = ["generic-tests"] }
 
 [[bench]]
 name = "blake2"

diff --git a/crates/algorithms/chacha20poly1305/Cargo.toml b/crates/algorithms/chacha20poly1305/Cargo.toml
@@ -16,7 +16,7 @@ libcrux-poly1305 = { version = "=0.0.6", path = "../poly1305/", features = [
 ] }
 libcrux-hacl-rs.workspace = true
 libcrux-macros = { version = "=0.0.3", path = "../../utils/macros" }
-libcrux-traits.workspace = true
+libcrux-traits = { workspace = true, default-features = true }
 libcrux-secrets.workspace = true
 
 [dev-dependencies]