Skip to content
ecdsa.com
HPKE

HPKE identifiers: KEMs, KDFs and AEADs

Hybrid Public Key Encryption identifiers of the IANA registry: KEMs with their key and encapsulation sizes, including ML-KEM and hybrids, KDFs and AEADs.

28 of 28 shown

HPKE KEM identifiers · 17 entries

Key encapsulation mechanisms for Hybrid Public Key Encryption (RFC 9180), including ML-KEM and hybrids.

ValueNameNencNpkNskNsecretAuth modesReferences
0x0010DHKEM(P-256, HKDF-SHA256)P-25665653232YesFIPS 186-4RFC 5869
0x0011DHKEM(P-384, HKDF-SHA384)P-38497974848YesFIPS 186-4RFC 5869
0x0012DHKEM(P-521, HKDF-SHA512)P-5211331336664YesFIPS 186-4RFC 5869
0x0013DHKEM(CP-256, HKDF-SHA256)P-25632323232YesFIPS 186-4RFC 6090draft-irtf-cfrg-dnhpke-01
0x0014DHKEM(CP-384, HKDF-SHA384)P-38448484848YesFIPS 186-4RFC 6090draft-irtf-cfrg-dnhpke-01
0x0015DHKEM(CP-521, HKDF-SHA512)P-52166666664YesFIPS 186-4RFC 6090draft-irtf-cfrg-dnhpke-01
0x0016DHKEM(secp256k1, HKDF-SHA256)secp256k165653232YesSEC 2draft-wahby-cfrg-hpke-kem-secp256k1-01
0x0020NoteDHKEM(X25519, HKDF-SHA256)curve2551932323232YesRFC 5869RFC 7748
0x0021DHKEM(X448, HKDF-SHA512)curve44856565664YesRFC 5869RFC 7748
0x0022DHKEM(X25519+Elligator, HKDF-SHA256)curve2551932323232Yeslsd.gnunet.org/lsd0011draft-schanzen-hpke-elligator-kem-01
0x0030X25519Kyber768Draft00curve2551911201216243264Nodraft-westerbaan-cfrg-hpke-xyber768d00-02
0x0040ML-KEM-5127688006432Nodraft-connolly-cfrg-hpke-mlkem-04
0x0041ML-KEM-768108811846432Nodraft-connolly-cfrg-hpke-mlkem-04
0x0042ML-KEM-1024156815686432Nodraft-connolly-cfrg-hpke-mlkem-04
0x0050MLKEM768-P256P-256115312493232Nodraft-ietf-hpke-pq-04
0x0051MLKEM1024-P384P-384166516653232Nodraft-ietf-hpke-pq-04
0x647ANoteX-Wingcurve25519112012163232Nodraft-connolly-cfrg-xwing-kem-06
Unassigned and reserved ranges · 8 entries
RangeStatusDescription
0x0000reservedReserved
0x0001–0x000FunassignedUnassigned
0x0017–0x001FunassignedUnassigned
0x0023–0x002FunassignedUnassigned
0x0031–0x003FunassignedUnassigned
0x0043–0x004FunassignedUnassigned
0x0052–0x6479unassignedUnassigned
0x647B–0xFFFFunassignedUnassigned

Source: Hybrid Public Key Encryption (HPKE) (IANA), retrieved 2026-10-20. Data license: CC0-1.0. HPKE KEM Identifiers

Notes on notable entries

DHKEM(X25519, HKDF-SHA256)

DHKEM(X25519, HKDF-SHA256), the HPKE KEM used by ECH, MLS and Oblivious HTTP.

HPKE (RFC 9180) turns Diffie–Hellman into a KEM by encapsulating to an ephemeral X25519 key; the 32-byte encapsulated key is the sender's ephemeral public key. It is the default KEM of Encrypted Client Hello configurations.

X-Wing

X-Wing, a hybrid KEM that combines ML-KEM-768 with X25519, registered for HPKE.

X-Wing (draft-connolly-cfrg-xwing-kem) derives its 32-byte shared secret with SHA3-256 over the ML-KEM-768 secret, the X25519 secret and the X25519 public values, giving a single KEM that stays secure as long as either component does. Encapsulated keys are 1,120 bytes and public keys 1,216 bytes.

HPKE KDF identifiers · 7 entries

Key derivation functions for HPKE.

ValueNameNhReferences
0x0001HKDF-SHA25632RFC 5869
0x0002HKDF-SHA38448RFC 5869
0x0003HKDF-SHA51264RFC 5869
0x0010SHAKE12832draft-ietf-hpke-pq-04
0x0011SHAKE25664draft-ietf-hpke-pq-04
0x0012TurboSHAKE12832draft-ietf-hpke-pq-04
0x0013TurboSHAKE25664draft-ietf-hpke-pq-04
Unassigned and reserved ranges · 3 entries
RangeStatusDescription
0x0000reservedReserved
0x0004–0x000FunassignedUnassigned
0x0014–0xFFFFunassignedUnassigned

Source: Hybrid Public Key Encryption (HPKE) (IANA), retrieved 2026-10-20. Data license: CC0-1.0. HPKE KDF Identifiers

HPKE AEAD identifiers · 4 entries

Authenticated encryption algorithms for HPKE.

ValueNameNkNnNtReferences
0x0001AES-128-GCM161216NIST SP 800-38D
0x0002AES-256-GCM321216NIST SP 800-38D
0x0003ChaCha20Poly1305321216RFC 8439
0xFFFFExport-only———RFC 9180
Unassigned and reserved ranges · 2 entries
RangeStatusDescription
0x0000reservedReserved
0x0004–0xFFFEunassignedUnassigned

Source: Hybrid Public Key Encryption (HPKE) (IANA), retrieved 2026-10-20. Data license: CC0-1.0. HPKE AEAD Identifiers

All registries