Managed HPKE - #133804
Open
vcsjones wants to merge 59 commits into
Open
Managed HPKE#133804vcsjones wants to merge 59 commits into
vcsjones wants to merge 59 commits into
Conversation
Add HPKE algorithm identifiers, suite validation and equality, shared tests, and Microsoft.Bcl.Cryptography support. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add KEM, KDF, and AEAD metadata, expose suite sizes and names, implement ciphertext length calculation, and extend shared public API tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add the initial Hpke API, managed algorithm support metadata, deterministic DHKEM key derivation and adapters for NIST curves and X25519. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Move the base, ECDH, and X25519 KEM adapters into grouped source files and apply curve-specific candidate masking for deterministic scalar derivation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Implement random and deterministic HPKE key creation, resource ownership, reference declarations, and known-answer tests for DHKEM P-256, P-384, and X25519. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Forward private-key export through the KEM adapters, clear temporary secret buffers, and add public export coverage. Centralize factory support guards in Hpke while retaining backend-specific support queries. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Expose public-key export through the KEM adapters, update reference declarations and tests, and clarify decapsulation-key export documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add public Seal scaffolding, KDF info-length validation, an AES-GCM adapter, and unsupported-platform dispatch. This is an intentionally incomplete, non-building checkpoint; SealCore remains unimplemented. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Implement DHKEM encapsulation, HKDF and SHAKE key schedules, and the ChaCha20-Poly1305 adapter. Centralize suite IDs and KEM labels, correct PRK slicing, and update Seal reference declarations. SealCore remains unimplemented. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Connect KEM encapsulation, the Base-mode key schedule, and AEAD encryption, and split the AEAD adapters into their own files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Replace fixed-size crypto pool leases with bounded stack allocations and explicit secret clearing. Retain conditional pooling for variable-length KDF inputs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add the approved Open APIs, DHKEM decapsulation, Base-mode authenticated decryption, and reference declarations. Cover known-answer vectors, round trips, input validation, and authentication failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add the approved multi-shot base APIs, shared exporter limits, and CreateSender wrappers with managed and unsupported backend stubs. Include reference declarations and public wrapper coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Initialize sender contexts with fresh encapsulation and Base-mode secrets. Add sequence-derived nonces, exhaustion checks, AEAD ownership and cleanup, and public factory and lifetime coverage. Leave secret export unimplemented. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add approved CreateRecipient APIs and Base-mode recipient setup with sequence-derived nonces, authentication-failure recovery, and resource cleanup. Cover published multi-message vectors, validation, ordering and independent lifetimes. Leave secret export unimplemented. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add approved PSK factories with a 32-byte minimum key length, nonempty identifiers, and KDF-specific input limits. Share Base and PSK context setup and cover published vectors, mode separation, authentication failures, and independent lifetimes. Leave secret export unimplemented. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add the approved KEM identifier, metadata, HKDF-SHA512 mapping, and P-521 scalar derivation. Increase bounded stack buffers and extend public coverage with published key and Base/PSK ciphertext vectors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Retain exporter secrets in fixed native memory and use the new span-capable UseKey overload for reference-protected exports. Remove nonce-only zeroing while preserving secret cleanup, and cover Base/PSK exporter vectors, length limits, sequencing and lifetimes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Add approved encapsulation and decapsulation key import overloads with NIST scalar validation, raw X25519 import, and exception-safe adapter ownership. Cover known-answer keys, malformed input, public-only operations, and imported key lifetimes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Guard the entire stateful SealCore operation with ConcurrencyBlock to prevent silent nonce reuse while preserving success-only sequence advancement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Reject input/output and output/output overlap before sender core operations while permitting read-only input aliasing. Document overlapping-buffer exceptions and cover rejection before mutation and adjacent buffer handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Document allocating Seal overloads and SealCore, and align buffer-length exception documentation with Open. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Forward all HPKE types on .NET 11, use the unsupported implementation on .NET Framework, and omit HPKE from .NET 10 and .NET Standard. Add required resources and restrict the HashCode dependency to the Framework HPKE build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Reject plaintext/input and exporter-context/destination overlap in public span overloads before invoking core operations. Document overlapping-buffer exceptions and cover rejection without mutation, empty spans and adjacent buffers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Validate arguments before disposal checks. Use bounded stack storage with allocation fallbacks for nonsecret KDF context buffers, retaining pooled handling for secret material. Cover disposed-input validation and the labeled-info stack threshold. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Address the API approval requirement, clear derived nonce buffers, and synchronize recipient sequence handling.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (3)
What changed in this PR
Adds experimental managed HPKE support with public APIs, DHKEM/KDF/AEAD implementations, compatibility forwarding, and comprehensive tests.
Changes:
- Adds HPKE APIs, metadata, diagnostics, and resource strings.
- Implements managed P-curve/X25519 KEMs, HKDF/SHAKE, and AEAD support.
- Adds packaging integration, test vectors, and contract tests.
| File | Description |
|---|---|
src/libraries/System.Security.Cryptography/tests/System.Security.Cryptography.Tests.csproj |
Registers HPKE tests. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeX25519DiffieHellmanKemAdapter.cs |
Implements X25519 KEM. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeManagedKemAdapter.cs |
Provides managed KEM infrastructure. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeManagedKdfAdapter.cs |
Provides HKDF/SHAKE derivation. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeManagedChaCha20Poly1305AeadAdapter.cs |
Adds ChaCha20-Poly1305 support. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeManagedAesAeadAdapter.cs |
Adds AES-GCM support. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeManagedAeadAdapter.cs |
Selects managed AEAD implementations. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeKemMetadata.Managed.cs |
Adds managed KEM metadata. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeKdfMetadata.Managed.cs |
Adds managed KDF support checks. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeImplementation.Unsupported.cs |
Defines unsupported-platform behavior. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeImplementation.Managed.cs |
Implements managed HPKE operations and contexts. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeECDiffieHellmanKemAdapter.cs |
Implements NIST DHKEM. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HpkeAeadMetadata.Managed.cs |
Adds managed AEAD support checks. |
src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/FixedMemoryKeyBox.cs |
Provides protected key storage. |
src/libraries/System.Security.Cryptography/src/System.Security.Cryptography.csproj |
Includes HPKE implementation files. |
src/libraries/System.Security.Cryptography/src/Resources/Strings.resx |
Adds HPKE error messages. |
src/libraries/System.Security.Cryptography/ref/System.Security.Cryptography.cs |
Defines the public HPKE contract. |
src/libraries/Microsoft.Bcl.Cryptography/tests/Microsoft.Bcl.Cryptography.Tests.csproj |
Registers BCL HPKE tests. |
src/libraries/Microsoft.Bcl.Cryptography/src/Resources/Strings.resx |
Adds forwarded HPKE resources. |
src/libraries/Microsoft.Bcl.Cryptography/src/Microsoft.Bcl.Cryptography.Forwards.cs |
Forwards HPKE types. |
src/libraries/Microsoft.Bcl.Cryptography/src/Microsoft.Bcl.Cryptography.csproj |
Builds HPKE for .NET Framework. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeTests.cs |
Tests HPKE validation. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeTestDataTests.cs |
Validates test-vector shape. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeTestData.cs |
Defines test-vector infrastructure. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeSuiteTests.cs |
Tests suite metadata and equality. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeSenderContractTests.cs |
Tests sender contracts. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeRecipientContractTests.cs |
Tests recipient contracts. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeNotSupportedTests.cs |
Tests unsupported suites. |
src/libraries/Common/tests/System/Security/Cryptography/HpkeKeyTests.cs |
Tests key generation, import, export, and validation. |
src/libraries/Common/src/System/Security/Cryptography/HpkeSuite.cs |
Defines HPKE suite metadata and APIs. |
src/libraries/Common/src/System/Security/Cryptography/HpkeSender.cs |
Defines sender contexts. |
src/libraries/Common/src/System/Security/Cryptography/HpkeRecipient.cs |
Defines recipient contexts. |
src/libraries/Common/src/System/Security/Cryptography/HpkeKemMetadata.cs |
Defines KEM metadata. |
src/libraries/Common/src/System/Security/Cryptography/HpkeKem.cs |
Defines KEM algorithms. |
src/libraries/Common/src/System/Security/Cryptography/HpkeKdfMetadata.cs |
Defines KDF metadata. |
src/libraries/Common/src/System/Security/Cryptography/HpkeKdf.cs |
Defines KDF algorithms. |
src/libraries/Common/src/System/Security/Cryptography/HpkeAeadMetadata.cs |
Defines AEAD metadata. |
src/libraries/Common/src/System/Security/Cryptography/HpkeAead.cs |
Defines AEAD algorithms. |
src/libraries/Common/src/System/Experimentals.cs |
Registers the HPKE experimental diagnostic. |
docs/project/list-of-diagnostics.md |
Documents SYSLIB5009. |
bartonjs
reviewed
Sep 19, 2026
bartonjs
reviewed
Sep 19, 2026
bartonjs
left a comment
bartonjs
left a comment
Member
There was a problem hiding this comment.
Got through the rest of it. I think there are a few open questions still, but definitely close to mergeable.
This was referenced Sep 21, 2026
bartonjs
approved these changes
Sep 21, 2026
vcsjones
enabled auto-merge (squash)
September 21, 2026 21:04
bartonjs
approved these changes
Sep 21, 2026
bartonjs
added
the
cryptographic-docs-impact
This was referenced Sep 21, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is the first commit for HPKE support.