Repository: cloudflare/daphne
Pull request #119 (2022-09-14 05:32:10)

Moving to hpke-rs
Moving away from `hpke` to `hpke-rs` crate.



Patch:
diff --git a/Cargo.lock b/Cargo.lock
index 58205d3..3a8e8bf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -11,16 +11,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "aead"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c192eb8f11fc081b0fe4259ba5af04217d4e0faddd02417310a927911abd7c8"
-dependencies = [
- "crypto-common",
- "generic-array",
-]
-
 [[package]]
 name = "aes"
 version = "0.7.5"
@@ -35,9 +25,9 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfe0133578c0986e1fe3dfcd4af1cc5b2dd6c3dbf534d69916ce16a2701d40ba"
+checksum = "433cfd6710c9986c576a25ca913c39d66a6474107b406f34f91d4a8923395241"
 dependencies = [
  "cfg-if",
  "cipher 0.4.3",
@@ -50,25 +40,11 @@ version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df5f85a83a7d8b0442b6aa7b504b8212c1733da07b98aae43d4bc21b2cb3cdf6"
 dependencies = [
- "aead 0.4.3",
+ "aead",
  "aes 0.7.5",
  "cipher 0.3.0",
  "ctr 0.8.0",
- "ghash 0.4.4",
- "subtle",
-]
-
-[[package]]
-name = "aes-gcm"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82e1366e0c69c9f927b1fa5ce2c7bf9eafc8f9268c0b9800729e8b267612447c"
-dependencies = [
- "aead 0.5.1",
- "aes 0.8.1",
- "cipher 0.4.3",
- "ctr 0.9.2",
- "ghash 0.5.0",
+ "ghash",
  "subtle",
 ]
 
@@ -86,26 +62,15 @@ checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
 
 [[package]]
 name = "async-trait"
-version = "0.1.58"
+version = "0.1.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e805d94e6b5001b651426cf4cd446b1ab5f319d27bab5c644f61de0a804360c"
+checksum = "31e6e93155431f3931513b243d371981bb2770112b370c82745a1d19d2f99364"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
-[[package]]
-name = "atty"
-version = "0.2.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
-dependencies = [
- "hermit-abi",
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "autocfg"
 version = "1.1.0"
@@ -130,12 +95,27 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
+[[package]]
+name = "base64ct"
+version = "1.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b645a089122eccb6111b4f81cbc1a49f5900ac4666bb93ac027feaecf15607bf"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.3"
@@ -153,9 +133,9 @@ checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
 
 [[package]]
 name = "bytemuck"
-version = "1.12.1"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f5715e491b5a1598fc2bef5a606847b5dc1d48ea625bd3c02c00de8285591da"
+checksum = "aaa3a8d9a1ca92e282c96a32d6511b695d7d994d1d102ba85d279f9b2756947f"
 
 [[package]]
 name = "byteorder"
@@ -165,15 +145,15 @@ checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
 [[package]]
 name = "bytes"
-version = "1.2.1"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec8a7b6a70fde80372154c65702f00a0f56f3e1c36abbc6c440484be248856db"
+checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
 
 [[package]]
 name = "cc"
-version = "1.0.73"
+version = "1.0.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+checksum = "e9f73505338f7d905b19d18738976aae232eb46b8efc15554ffc56deb5d9ebe4"
 
 [[package]]
 name = "cfg-if"
@@ -183,33 +163,34 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "chacha20"
-version = "0.9.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7fc89c7c5b9e7a02dfe45cd2367bae382f9ed31c61ca8debe5f827c420a2f08"
+checksum = "5c80e5460aa66fe3b91d40bcbdab953a597b60053e34d684ac6903f863b680a6"
 dependencies = [
  "cfg-if",
- "cipher 0.4.3",
+ "cipher 0.3.0",
  "cpufeatures",
+ "zeroize",
 ]
 
 [[package]]
 name = "chacha20poly1305"
-version = "0.10.1"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+checksum = "a18446b09be63d457bbec447509e85f662f32952b035ce892290396bc0b0cff5"
 dependencies = [
- "aead 0.5.1",
+ "aead",
  "chacha20",
- "cipher 0.4.3",
+ "cipher 0.3.0",
  "poly1305",
  "zeroize",
 ]
 
 [[package]]
 name = "chrono"
-version = "0.4.22"
+version = "0.4.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfd4d1b31faaa3a89d7934dbded3111da0d2ef28e3ebccdb4f0179f5929d1ef1"
+checksum = "16b0a3d9ed01224b22057780a37bb8c5dbfe1be8ba48678e7bf57ec4b385411f"
 dependencies = [
  "js-sys",
  "num-integer",
@@ -256,19 +237,18 @@ checksum = "d1873270f8f7942c191139cb8a40fd228da6c3fd2fc376d7e92d47aa14aeb59e"
 dependencies = [
  "crypto-common",
  "inout",
- "zeroize",
 ]
 
 [[package]]
 name = "clap"
-version = "4.0.18"
+version = "4.0.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335867764ed2de42325fafe6d18b8af74ba97ee0c590fa016f157535b42ab04b"
+checksum = "4d63b9e9c07271b9957ad22c173bae2a4d9a81127680962039296abcd2f8251d"
 dependencies = [
- "atty",
  "bitflags",
  "clap_derive",
  "clap_lex",
+ "is-terminal",
  "once_cell",
  "strsim",
  "termcolor",
@@ -276,9 +256,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.0.18"
+version = "4.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16a1b0f6422af32d5da0c58e2703320f379216ee70198241c84173a8c5ac28f3"
+checksum = "0177313f9f02afc995627906bbd8967e2be069f5261954222dac78290c2b9014"
 dependencies = [
  "heck",
  "proc-macro-error",
@@ -304,7 +284,7 @@ checksum = "606383658416244b8dc4b36f864ec1f86cb922b95c41a908fd07aeb01cad06fa"
 dependencies = [
  "cipher 0.4.3",
  "dbl",
- "digest 0.10.5",
+ "digest 0.10.6",
 ]
 
 [[package]]
@@ -319,9 +299,9 @@ dependencies = [
 
 [[package]]
 name = "const-oid"
-version = "0.9.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "722e23542a15cea1f65d4a1419c4cfd7a26706c70871a13a04238ca3f40f1661"
+checksum = "e4c78c047431fee22c1a7bb92e00ad095a02a983affe4d8a72e2a2c62c1b94f3"
 
 [[package]]
 name = "core-foundation"
@@ -356,12 +336,12 @@ checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
 
 [[package]]
 name = "crypto-bigint"
-version = "0.4.9"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
+checksum = "03c6a1d5fa1de37e071642dfa44ec552ca5b299adb128fab16138e24b548fd21"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
  "zeroize",
 ]
@@ -373,10 +353,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-mac"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714"
+dependencies = [
+ "generic-array",
+ "subtle",
+]
+
 [[package]]
 name = "ctr"
 version = "0.8.0"
@@ -396,15 +385,15 @@ dependencies = [
 ]
 
 [[package]]
-name = "curve25519-dalek"
-version = "3.2.0"
+name = "curve25519-dalek-ng"
+version = "4.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9fdf9972b2bd6af2d913799d9ebc165ea4d2e65878e329d9c6b372c4491b61"
+checksum = "1c359b7249347e46fb28804470d071c921156ad62b3eef5d34e2ba867533dec8"
 dependencies = [
  "byteorder",
  "digest 0.9.0",
- "rand_core 0.5.1",
- "subtle",
+ "rand_core",
+ "subtle-ng",
  "zeroize",
 ]
 
@@ -434,7 +423,9 @@ dependencies = [
  "base64",
  "getrandom",
  "hex",
- "hpke",
+ "hpke-rs",
+ "hpke-rs-crypto",
+ "hpke-rs-rust-crypto",
  "matchit 0.6.0",
  "paste",
  "prio",
@@ -482,7 +473,6 @@ dependencies = [
  "futures",
  "getrandom",
  "hex",
- "hpke",
  "matchit 0.6.0",
  "prio",
  "rand",
@@ -506,9 +496,9 @@ dependencies = [
 
 [[package]]
 name = "der"
-version = "0.6.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dd2ae565c0a381dde7fade45fce95984c568bdcb4700a4fdbe3175e0380b2f"
+checksum = "6919815d73839e7ad218de758883aae3a257ba6759ce7a9992501efbb53d705c"
 dependencies = [
  "const-oid",
 ]
@@ -524,30 +514,40 @@ dependencies = [
 
 [[package]]
 name = "digest"
-version = "0.10.5"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adfbc57365a37acbd2ebf2b64d7e69bb766e2fea813521ed536f5d0520dcf86c"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
 dependencies = [
- "block-buffer",
+ "block-buffer 0.10.3",
  "crypto-common",
  "subtle",
 ]
 
+[[package]]
+name = "ecdsa"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0d69ae62e0ce582d56380743515fefaf1a8c70cec685d9677636d7e30ae9dc9"
+dependencies = [
+ "der",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+]
+
 [[package]]
 name = "elliptic-curve"
-version = "0.12.3"
+version = "0.11.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
+checksum = "25b477563c2bfed38a3b7a60964c49e058b2510ad3f12ba3483fd8f62c2306d6"
 dependencies = [
  "base16ct",
  "crypto-bigint",
  "der",
- "digest 0.10.5",
  "ff",
  "generic-array",
  "group",
- "hkdf",
- "rand_core 0.6.4",
+ "rand_core",
  "sec1",
  "subtle",
  "zeroize",
@@ -562,6 +562,27 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "errno"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
 [[package]]
 name = "fastrand"
 version = "1.8.0"
@@ -573,19 +594,19 @@ dependencies = [
 
 [[package]]
 name = "ff"
-version = "0.12.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df689201f395c6b90dfe87127685f8dbfc083a5e779e613575d8bd7314300c3e"
+checksum = "131655483be284720a17d74ff97592b8e76576dc25563148601df2d7c9080924"
 dependencies = [
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
 [[package]]
 name = "fixed"
-version = "1.19.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0371cd413fb63f8ec1b9eb4dff47fa2c88b21abc681771234c84808b9920991"
+checksum = "418922d2c280b8c68f82699494cc8c48f392233233a9a8b9a48a57a36c0ad0ef"
 dependencies = [
  "az",
  "bytemuck",
@@ -718,7 +739,6 @@ version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
 dependencies = [
- "serde",
  "typenum",
  "version_check",
 ]
@@ -743,27 +763,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1583cc1656d7839fd3732b80cf4f38850336cdb9b8ded1cd399ca62958de3c99"
 dependencies = [
  "opaque-debug",
- "polyval 0.5.3",
-]
-
-[[package]]
-name = "ghash"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d930750de5717d2dd0b8c0d42c076c0e884c81a73e6cab859bbd2339c71e3e40"
-dependencies = [
- "opaque-debug",
- "polyval 0.6.0",
+ "polyval",
 ]
 
 [[package]]
 name = "group"
-version = "0.12.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
+checksum = "bc5ac374b108929de78460075f3dc439fa66df9d8fc77e8f12caa5165fcf0c89"
 dependencies = [
  "ff",
- "rand_core 0.6.4",
+ "rand_core",
  "subtle",
 ]
 
@@ -816,6 +826,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -831,7 +850,17 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
 dependencies = [
- "hmac",
+ "hmac 0.12.1",
+]
+
+[[package]]
+name = "hmac"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
+dependencies = [
+ "crypto-mac",
+ "digest 0.9.0",
 ]
 
 [[package]]
@@ -840,30 +869,50 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest 0.10.5",
+ "digest 0.10.6",
 ]
 
 [[package]]
-name = "hpke"
-version = "0.10.0"
+name = "hpke-rs"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf39e5461bfdc6ad0fbc97067519fcaf96a7a2e67f24cc0eb8a1e7c0c45af792"
+checksum = "c9c8449efb0694b5dd0ee0d7a5582eccce1eb3aeb6c25dc569143ceadc536ca5"
 dependencies = [
- "aead 0.5.1",
- "aes-gcm 0.10.1",
- "byteorder",
+ "hpke-rs-crypto",
+ "log",
+ "zeroize",
+]
+
+[[package]]
+name = "hpke-rs-crypto"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fdcfe5eed821c92bedc9d05a1e8b4d42a858e5326031086bb5256b778ce9455"
+dependencies = [
+ "getrandom",
+ "rand",
+ "serde",
+ "serde_json",
+ "tls_codec",
+]
+
+[[package]]
+name = "hpke-rs-rust-crypto"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8603fbb7674b627cb9f3de6ae5ba8b7e621ef5fdea6489363cb4bef26e5fce52"
+dependencies = [
+ "aes-gcm",
  "chacha20poly1305",
- "digest 0.10.5",
- "generic-array",
+ "getrandom",
  "hkdf",
- "hmac",
+ "hpke-rs-crypto",
  "p256",
- "rand_core 0.6.4",
- "serde",
- "sha2",
- "subtle",
- "x25519-dalek",
- "zeroize",
+ "p384",
+ "rand",
+ "rand_chacha",
+ "sha2 0.10.6",
+ "x25519-dalek-ng",
 ]
 
 [[package]]
@@ -902,9 +951,9 @@ checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
 
 [[package]]
 name = "hyper"
-version = "0.14.20"
+version = "0.14.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02c929dc5c39e335a03c405292728118860721b10190d98c2a0f0efd5baafbac"
+checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -949,9 +998,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "1.9.1"
+version = "1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10a35a97730320ffe8e2d410b5d3b69279b98d2c14bdb8b70ea89ecf7888d41e"
+checksum = "1885e79c1fc4b10f0e172c475f458b7f7b93061064d98c3293e98c5ba0c8b399"
 dependencies = [
  "autocfg",
  "hashbrown",
@@ -975,11 +1024,33 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "io-lifetimes"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46112a93252b123d31a119a8d1a1ac19deac4fac6e0e8b0df58f0d4e5870e63c"
+dependencies = [
+ "libc",
+ "windows-sys 0.42.0",
+]
+
 [[package]]
 name = "ipnet"
-version = "2.5.0"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f88c5561171189e69df9d98bcf18fd5f9558300f7ea7b801eb8a0fd748bd8745"
+
+[[package]]
+name = "is-terminal"
+version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879d54834c8c76457ef4293a689b2a8c59b076067ad77b15efafbb05f92a592b"
+checksum = "927609f78c2913a6f6ac3c27a4fe87f43e2a35367c0c4b0f8265e8f49a104330"
+dependencies = [
+ "hermit-abi 0.2.6",
+ "io-lifetimes",
+ "rustix",
+ "windows-sys 0.42.0",
+]
 
 [[package]]
 name = "itoa"
@@ -1004,9 +1075,15 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.136"
+version = "0.2.137"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55edcf6c0bb319052dea84732cf99db461780fd5e8d3eb46ab6ff312ab31f197"
+checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f9f08d8963a6c613f4b1a78f4f4a4dbfadf8e6545b2d72861731e4858b8b47f"
 
 [[package]]
 name = "lock_api"
@@ -1065,9 +1142,9 @@ dependencies = [
 
 [[package]]
 name = "native-tls"
-version = "0.2.10"
+version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd7e2f3618557f980e0b17e8856252eee3c97fa12c54dff0ca290fb6266ca4a9"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
 dependencies = [
  "lazy_static",
  "libc",
@@ -1102,19 +1179,19 @@ dependencies = [
 
 [[package]]
 name = "num_cpus"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
+checksum = "f6058e64324c71e02bc2b150e4f3bc8286db6c83092132ffa3f6b1eab0f9def5"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.1.19",
  "libc",
 ]
 
 [[package]]
 name = "once_cell"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e82dad04139b71a90c080c8463fe0dc7902db5192d939bd0950f074d014339e1"
+checksum = "86f0b0d4bf799edbc74508c1e8bf170ff5f41238e5f8225603ca7caaae2b7860"
 
 [[package]]
 name = "opaque-debug"
@@ -1124,9 +1201,9 @@ checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
 name = "openssl"
-version = "0.10.42"
+version = "0.10.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12fc0523e3bd51a692c8850d075d74dc062ccf251c0110668cbd921917118a13"
+checksum = "020433887e44c27ff16365eaa2d380547a94544ad509aff6eb5b6e3e0b27b376"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -1156,9 +1233,9 @@ checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.77"
+version = "0.9.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b03b84c3b2d099b81f0953422b4d4ad58761589d0229b5506356afca05a3670a"
+checksum = "07d5c8cb6e57b3a3612064d7b18b117912b4ce70955c2504d4b741c9e244b132"
 dependencies = [
  "autocfg",
  "cc",
@@ -1169,17 +1246,30 @@ dependencies = [
 
 [[package]]
 name = "os_str_bytes"
-version = "6.3.0"
+version = "6.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
+checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
 
 [[package]]
 name = "p256"
-version = "0.11.1"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19736d80675fbe9fe33426268150b951a3fb8f5cfca2a23a17c85ef3adb24e3b"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "sec1",
+ "sha2 0.9.9",
+]
+
+[[package]]
+name = "p384"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
+checksum = "755d8266e41f57bd8562ed9b6e93cdcf73ead050e1e8c3a27ea3871b6643a20c"
 dependencies = [
  "elliptic-curve",
+ "sec1",
 ]
 
 [[package]]
@@ -1194,9 +1284,9 @@ dependencies = [
 
 [[package]]
 name = "parking_lot_core"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4dc9e0dc2adc1c69d09143aff38d3d30c5c3f0df0dad82e6d25547af174ebec0"
+checksum = "7ff9f3fef3968a3ec5945535ed654cb38ff72d7495a25619e2247fb15a2ed9ba"
 dependencies = [
  "cfg-if",
  "libc",
@@ -1297,21 +1387,32 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkcs8"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cabda3fb821068a9a4fab19a683eac3af12edf0f34b94a8be53c4972b8149d0"
+dependencies = [
+ "der",
+ "spki",
+ "zeroize",
+]
+
 [[package]]
 name = "pkg-config"
-version = "0.3.25"
+version = "0.3.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1df8c4ec4b0627e53bdf214615ad287367e482558cf84b109250b37464dc03ae"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
 
 [[package]]
 name = "poly1305"
-version = "0.8.0"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+checksum = "048aeb476be11a4b6ca432ca569e375810de9294ae78f4774e78ea98a9246ede"
 dependencies = [
  "cpufeatures",
  "opaque-debug",
- "universal-hash 0.5.0",
+ "universal-hash",
 ]
 
 [[package]]
@@ -1323,26 +1424,14 @@ dependencies = [
  "cfg-if",
  "cpufeatures",
  "opaque-debug",
- "universal-hash 0.4.1",
-]
-
-[[package]]
-name = "polyval"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ef234e08c11dfcb2e56f79fd70f6f2eb7f025c0ce2333e82f4f0518ecad30c6"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "opaque-debug",
- "universal-hash 0.5.0",
+ "universal-hash",
 ]
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "prio"
@@ -1350,8 +1439,8 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0453e1ec5f2f48af9a67aab1d812f9aec48619dda0d9a59e2f79ebd235448ec"
 dependencies = [
- "aes 0.8.1",
- "aes-gcm 0.9.4",
+ "aes 0.8.2",
+ "aes-gcm",
  "base64",
  "byteorder",
  "cmac",
@@ -1414,7 +1503,7 @@ checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
  "rand_chacha",
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
 [[package]]
@@ -1424,15 +1513,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.6.4",
+ "rand_core",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -1453,18 +1536,18 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.6.0"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+checksum = "e076559ef8e241f2ae3479e36f97bd5741c0330689e217ad51ce2c76808b868a"
 dependencies = [
  "regex-syntax",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.27"
+version = "0.6.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
 
 [[package]]
 name = "remove_dir_all"
@@ -1477,9 +1560,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.12"
+version = "0.11.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "431949c384f4e2ae07605ccaa56d1d9d2ecdb5cadd4f9577ccfab29f2e5149fc"
+checksum = "68cc60575865c7831548863cc02356512e3f1dc2f3f82cb837d7fc4cc8f3c97c"
 dependencies = [
  "base64",
  "bytes",
@@ -1550,6 +1633,17 @@ dependencies = [
  "winreg",
 ]
 
+[[package]]
+name = "rfc6979"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96ef608575f6392792f9ecf7890c00086591d29a83910939d430753f7c050525"
+dependencies = [
+ "crypto-bigint",
+ "hmac 0.11.0",
+ "zeroize",
+]
+
 [[package]]
 name = "ring"
 version = "0.16.20"
@@ -1565,6 +1659,20 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "rustix"
+version = "0.36.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb93e85278e08bb5788653183213d3a60fc242b10cb9be96586f5a73dcb67c23"
+dependencies = [
+ "bitflags",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.42.0",
+]
+
 [[package]]
 name = "ryu"
 version = "1.0.11"
@@ -1589,13 +1697,13 @@ checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
 name = "sec1"
-version = "0.3.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
+checksum = "08da66b8b0965a5555b6bd6639e68ccba85e1e2506f5fbb089e93f8a04e1a2d1"
 dependencies = [
- "base16ct",
  "der",
  "generic-array",
+ "pkcs8",
  "subtle",
  "zeroize",
 ]
@@ -1625,18 +1733,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.147"
+version = "1.0.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d193d69bae983fc11a79df82342761dfbf28a99fc8d203dca4c3c1b590948965"
+checksum = "e53f64bb4ba0191d6d0676e1b141ca55047d83b74f5607e6d8eb88126c52c2dc"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.147"
+version = "1.0.148"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f1d362ca8fc9c3e3a7484440752472d68a6caa98f1ab81d99b5dfe517cec852"
+checksum = "a55492425aa53521babf6137309e7d34c20bbfbbfcfe2c7f3a047fd1f6b92c0c"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1645,9 +1753,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.87"
+version = "1.0.89"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ce777b7b150d76b9cf60d28b55f5847135a003f7d7350c6be7a773508ce7d45"
+checksum = "020ff22c755c2ed3f8cf162dbb41a7268d934702f3ed3631656ea597e08fc3db"
 dependencies = [
  "itoa",
  "ryu",
@@ -1666,6 +1774,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.6"
@@ -1674,7 +1795,7 @@ checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
 dependencies = [
  "cfg-if",
  "cpufeatures",
- "digest 0.10.5",
+ "digest 0.10.6",
 ]
 
 [[package]]
@@ -1686,6 +1807,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02658e48d89f2bec991f9a78e69cfa4c316f8d6a6c4ec12fae1aeb263d486788"
+dependencies = [
+ "digest 0.9.0",
+ "rand_core",
+]
+
 [[package]]
 name = "siphasher"
 version = "0.3.10"
@@ -1723,6 +1854,16 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
+[[package]]
+name = "spki"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d01ac02a6ccf3e07db148d2be087da624fea0221a16152ed01f0496a6b0a27"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "static_assertions"
 version = "1.1.0"
@@ -1741,11 +1882,17 @@ version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
 
+[[package]]
+name = "subtle-ng"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "734676eb262c623cec13c3155096e08d1f8f29adce39ba17948b18dad1e54142"
+
 [[package]]
 name = "syn"
-version = "1.0.103"
+version = "1.0.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a864042229133ada95abf3b54fdc62ef5ccabe9515b64717bcb9a1919e59445d"
+checksum = "60b9b43d45702de4c839cb9b51d9f529c5dd26a4aff255b42b1ebc03e88ee908"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1822,11 +1969,32 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
 
+[[package]]
+name = "tls_codec"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "172a9c24d46b5fe280b77f37161ed9a919229cb104085384e8bf30637c2e4bca"
+dependencies = [
+ "tls_codec_derive",
+ "zeroize",
+]
+
+[[package]]
+name = "tls_codec_derive"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a787719c86efec1535b071bde678f5fd649380e8005cd1ebd0afeb4bcc4d2a85"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "tokio"
-version = "1.21.2"
+version = "1.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9e03c497dc955702ba729190dc4aac6f2a0ce97f913e5b1b5912fc5039d9099"
+checksum = "d76ce4a75fb488c605c54bf610f221cea8b0dafb53333c1a67e8ee199dcd2ae3"
 dependencies = [
  "autocfg",
  "bytes",
@@ -1844,9 +2012,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "1.8.0"
+version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
+checksum = "d266c00fde287f55d3f1c3e96c500c362a2b8c695076ec180f27918820bc6df8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1961,16 +2129,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "universal-hash"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d3160b73c9a19f7e2939a2fdad446c57c1bbbbf4d919d3213ff1267a580d8b5"
-dependencies = [
- "crypto-common",
- "subtle",
-]
-
 [[package]]
 name = "untrusted"
 version = "0.7.1"
@@ -2318,13 +2476,14 @@ dependencies = [
 ]
 
 [[package]]
-name = "x25519-dalek"
-version = "2.0.0-pre.1"
+name = "x25519-dalek-ng"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5da623d8af10a62342bcbbb230e33e58a63255a58012f8653c578e54bab48df"
+checksum = "bf7074de8999662970c3c4c8f7f30925028dd8f4ca31ad4c055efa9cdf2ec326"
 dependencies = [
- "curve25519-dalek",
- "rand_core 0.6.4",
+ "curve25519-dalek-ng",
+ "rand",
+ "rand_core",
  "zeroize",
 ]
 
@@ -2339,9 +2498,9 @@ dependencies = [
 
 [[package]]
 name = "zeroize_derive"
-version = "1.3.2"
+version = "1.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f8f187641dad4f680d25c4bfc4225b418165984179f26ca76ec4fb6441d3a17"
+checksum = "44bf07cb3e50ea2003396695d58bf46bc9887a1f362260446fad6bc4e79bd36c"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/daphne/Cargo.toml b/daphne/Cargo.toml
index af1fcb0..82f72c6 100644
--- a/daphne/Cargo.toml
+++ b/daphne/Cargo.toml
@@ -24,7 +24,9 @@ base64 = "0.13.1"
 getrandom = { version = "0.2.8", features = ["js"] } # Required for prio
 serde_json = "1.0.87"
 prio = { version = "0.10.0", features = ["prio2"] }
-hpke = { version = "0.10.0", features = ["std", "serde_impls"] }
+hpke-rs = { version = "0.1.0" , features = ["hazmat"] }
+hpke-rs-crypto = { version = "0.1.1" }
+hpke-rs-rust-crypto = { version = "0.1.1"}
 ring = "0.16.20"
 hex = { version = "0.4.3", features = ["serde"] }
 serde = { version = "1.0.147", features = ["derive"] }
diff --git a/daphne/src/hpke.rs b/daphne/src/hpke.rs
index 701e4a6..0de8003 100644
--- a/daphne/src/hpke.rs
+++ b/daphne/src/hpke.rs
@@ -3,6 +3,14 @@
 
 //! Hybrid Public-Key Encryption ([HPKE](https://datatracker.ietf.org/doc/rfc9180/)).
 
+use hpke_rs::{Hpke, HpkeError, HpkePrivateKey, HpkePublicKey, Mode};
+use hpke_rs_crypto::{
+    error::Error,
+    types::{AeadAlgorithm, KdfAlgorithm, KemAlgorithm},
+    HpkeCrypto,
+};
+use hpke_rs_rust_crypto::HpkeRustCrypto as ImplHpkeCrypto;
+
 use crate::{
     messages::{
         decode_u16_bytes, encode_u16_bytes, HpkeAeadId, HpkeCiphertext, HpkeConfig, HpkeKdfId,
@@ -11,25 +19,47 @@ use crate::{
     DapError,
 };
 use async_trait::async_trait;
-use hpke::{aead, kdf, kem, Deserializable, Kem, OpModeR};
 use prio::codec::{CodecError, Decode, Encode};
 use serde::{Deserialize, Serialize};
 use std::io::Cursor;
 
-impl HpkeConfig {
-    fn check_suite(&self) -> Result<(), DapError> {
-        match (self.kem_id, self.kdf_id, self.aead_id) {
-            (HpkeKemId::P256HkdfSha256, HpkeKdfId::HkdfSha256, HpkeAeadId::Aes128Gcm) => Ok(()),
-            (HpkeKemId::X25519HkdfSha256, HpkeKdfId::HkdfSha256, HpkeAeadId::Aes128Gcm) => Ok(()),
-            (kem_id, kdf_id, aead_id) => Err(DapError::Fatal(format!(
-                "HPKE ciphersuite not implemented ({}, {}, {})",
-                u16::from(kem_id),
-                u16::from(kdf_id),
-                u16::from(aead_id)
-            ))),
+impl From<HpkeError> for DapError {
+    fn from(_e: HpkeError) -> Self {
+        Self::Transition(TransitionFailure::HpkeDecryptError)
+    }
+}
+
+impl From<Error> for DapError {
+    fn from(_e: Error) -> Self {
+        Self::Transition(TransitionFailure::HpkeDecryptError)
+    }
+}
+
+fn check_suite<T: HpkeCrypto>(
+    kem_id: HpkeKemId,
+    kdf_id: HpkeKdfId,
+    aead_id: HpkeAeadId,
+) -> Result<Hpke<T>, DapError> {
+    let s = format!(
+        "HPKE ciphersuite not implemented ({}, {}, {})",
+        u16::from(kem_id),
+        u16::from(kdf_id),
+        u16::from(aead_id)
+    );
+    let maperr = |_| DapError::Fatal(s.clone());
+    let kem = KemAlgorithm::try_from(u16::from(kem_id)).map_err(maperr)?;
+    let kdf = KdfAlgorithm::try_from(u16::from(kdf_id)).map_err(maperr)?;
+    let aead = AeadAlgorithm::try_from(u16::from(aead_id)).map_err(maperr)?;
+    match (kem, kdf, aead) {
+        (KemAlgorithm::DhKemP256, KdfAlgorithm::HkdfSha256, AeadAlgorithm::Aes128Gcm)
+        | (KemAlgorithm::DhKem25519, KdfAlgorithm::HkdfSha256, AeadAlgorithm::Aes128Gcm) => {
+            Ok(Hpke::new(Mode::Base, kem, kdf, aead))
         }
+        _ => Err(DapError::Fatal(s)),
     }
+}
 
+impl HpkeConfig {
     /// Encrypt `plaintext` with info string `info` and associated data `aad` using this HPKE
     /// configuration. The return values are the encapsulated key and the ciphertext.
     pub fn encrypt(
@@ -38,44 +68,26 @@ impl HpkeConfig {
         aad: &[u8],
         plaintext: &[u8],
     ) -> Result<(Vec<u8>, Vec<u8>), DapError> {
-        use hpke::{OpModeS, Serializable};
-
-        self.check_suite()?;
-
-        // Note: this is a fairly ugly way of dealing with agility in rust-hpke, but it's
-        // a temporary workaround until we have a more ergonomic HPKE library.
-        match self.kem_id {
-            HpkeKemId::P256HkdfSha256 => {
-                let pk = <kem::DhP256HkdfSha256 as Kem>::PublicKey::from_bytes(&self.public_key)?;
-                let (enc, mut sender) = hpke::setup_sender::<
-                    aead::AesGcm128,
-                    kdf::HkdfSha256,
-                    kem::DhP256HkdfSha256,
-                    _,
-                >(
-                    &OpModeS::Base, &pk, info, &mut rand::thread_rng()
-                )?;
-
-                Ok((enc.to_bytes().to_vec(), sender.seal(plaintext, aad)?))
-            }
-            HpkeKemId::X25519HkdfSha256 => {
-                let pk = <kem::X25519HkdfSha256 as Kem>::PublicKey::from_bytes(&self.public_key)?;
-                let (enc, mut sender) = hpke::setup_sender::<
-                    aead::AesGcm128,
-                    kdf::HkdfSha256,
-                    kem::X25519HkdfSha256,
-                    _,
-                >(
-                    &OpModeS::Base, &pk, info, &mut rand::thread_rng()
-                )?;
+        let sender: Hpke<ImplHpkeCrypto> = check_suite(self.kem_id, self.kdf_id, self.aead_id)?;
+        let pk = HpkePublicKey::new(self.public_key.clone());
+        let (enc, mut ctx) = sender.setup_sender(&pk, info, None, None, None)?;
+        let ciphertext = ctx.seal(aad, plaintext)?;
+        Ok((enc, ciphertext))
+    }
 
-                Ok((enc.to_bytes().to_vec(), sender.seal(plaintext, aad)?))
-            }
-            _ => {
-                // We should never get here.
-                panic!("Unsupported KEM ({:?})", self.kem_id);
-            }
-        }
+    pub(crate) fn decrypt(
+        &self,
+        secret_key: &[u8],
+        info: &[u8],
+        aad: &[u8],
+        enc: &[u8],
+        ciphertext: &[u8],
+    ) -> Result<Vec<u8>, DapError> {
+        let receiver: Hpke<ImplHpkeCrypto> = check_suite(self.kem_id, self.kdf_id, self.aead_id)?;
+        let sk = HpkePrivateKey::new(secret_key.to_vec());
+        let mut ctx = receiver.setup_receiver(enc, &sk, info, None, None, None)?;
+        let plaintext = ctx.open(aad, ciphertext)?;
+        Ok(plaintext)
     }
 }
 
@@ -113,66 +125,13 @@ pub struct HpkeReceiverConfig {
 }
 
 impl HpkeReceiverConfig {
-    // Check that the cipher suite is the one we support.
-    fn check_suite(&self) -> Result<(), DapError> {
-        match (self.config.kem_id, self.config.kdf_id, self.config.aead_id) {
-            (HpkeKemId::P256HkdfSha256, HpkeKdfId::HkdfSha256, HpkeAeadId::Aes128Gcm) => Ok(()),
-            (HpkeKemId::X25519HkdfSha256, HpkeKdfId::HkdfSha256, HpkeAeadId::Aes128Gcm) => Ok(()),
-            (kem_id, kdf_id, aead_id) => Err(DapError::Fatal(format!(
-                "HPKE ciphersuite not implemented ({}, {}, {})",
-                u16::from(kem_id),
-                u16::from(kdf_id),
-                u16::from(aead_id)
-            ))),
-        }
-    }
-
     pub fn encrypt(
         &self,
         info: &[u8],
         aad: &[u8],
         plaintext: &[u8],
     ) -> Result<(Vec<u8>, Vec<u8>), DapError> {
-        use hpke::{OpModeS, Serializable};
-
-        self.check_suite()?;
-
-        // Note: this is a fairly ugly way of dealing with agility in rust-hpke, but it's
-        // a temporary workaround until we have a more ergonomic HPKE library.
-        match self.config.kem_id {
-            HpkeKemId::P256HkdfSha256 => {
-                let pk =
-                    <kem::DhP256HkdfSha256 as Kem>::PublicKey::from_bytes(&self.config.public_key)?;
-                let (enc, mut sender) = hpke::setup_sender::<
-                    aead::AesGcm128,
-                    kdf::HkdfSha256,
-                    kem::DhP256HkdfSha256,
-                    _,
-                >(
-                    &OpModeS::Base, &pk, info, &mut rand::thread_rng()
-                )?;
-
-                Ok((enc.to_bytes().to_vec(), sender.seal(plaintext, aad)?))
-            }
-            HpkeKemId::X25519HkdfSha256 => {
-                let pk =
-                    <kem::X25519HkdfSha256 as Kem>::PublicKey::from_bytes(&self.config.public_key)?;
-                let (enc, mut sender) = hpke::setup_sender::<
-                    aead::AesGcm128,
-                    kdf::HkdfSha256,
-                    kem::X25519HkdfSha256,
-                    _,
-                >(
-                    &OpModeS::Base, &pk, info, &mut rand::thread_rng()
-                )?;
-
-                Ok((enc.to_bytes().to_vec(), sender.seal(plaintext, aad)?))
-            }
-            _ => {
-                // We should never get here.
-                unreachable!("Unsupported KEM ({:?})", self.config.kem_id);
-            }
-        }
+        self.config.encrypt(info, aad, plaintext)
     }
 
     /// Decrypt `ciphertext` with info string `info` and associated data `aad` using this HPKE
@@ -184,75 +143,41 @@ impl HpkeReceiverConfig {
         enc: &[u8],
         ciphertext: &[u8],
     ) -> Result<Vec<u8>, DapError> {
-        self.check_suite()?;
-
-        // Note: this is a fairly ugly way of dealing with agility in rust-hpke, but it's
-        // a temporary workaround until we have a more ergonomic HPKE library.
-        match self.config.kem_id {
-            HpkeKemId::P256HkdfSha256 => {
-                let sk = <kem::DhP256HkdfSha256 as Kem>::PrivateKey::from_bytes(&self.secret_key)?;
-                let enc = <kem::DhP256HkdfSha256 as Kem>::EncappedKey::from_bytes(enc)?;
-                let mut receiver = hpke::setup_receiver::<
-                    aead::AesGcm128,
-                    kdf::HkdfSha256,
-                    kem::DhP256HkdfSha256,
-                >(&OpModeR::Base, &sk, &enc, info)?;
-                let pt = receiver.open(ciphertext, aad)?;
-                Ok(pt)
-            }
-            HpkeKemId::X25519HkdfSha256 => {
-                let sk = <kem::X25519HkdfSha256 as Kem>::PrivateKey::from_bytes(&self.secret_key)?;
-                let enc = <kem::X25519HkdfSha256 as Kem>::EncappedKey::from_bytes(enc)?;
-                let mut receiver = hpke::setup_receiver::<
-                    aead::AesGcm128,
-                    kdf::HkdfSha256,
-                    kem::X25519HkdfSha256,
-                >(&OpModeR::Base, &sk, &enc, info)?;
-                let pt = receiver.open(ciphertext, aad)?;
-                Ok(pt)
-            }
-            _ => {
-                // We should never get here.
-                unreachable!("Unsupported KEM ({:?})", self.config.kem_id);
-            }
-        }
+        self.config
+            .decrypt(&self.secret_key, info, aad, enc, ciphertext)
     }
 
     /// Generate and return a new HPKE receiver context given a HPKE config ID and HPKE KEM.
-    pub fn gen(id: u8, kem_id: HpkeKemId) -> Self {
-        use hpke::Serializable;
-
-        match kem_id {
-            HpkeKemId::X25519HkdfSha256 => {
-                let (sk, pk) = kem::X25519HkdfSha256::gen_keypair(&mut rand::thread_rng());
-                HpkeReceiverConfig {
-                    config: HpkeConfig {
-                        id,
-                        kem_id,
-                        kdf_id: HpkeKdfId::HkdfSha256,
-                        aead_id: HpkeAeadId::Aes128Gcm,
-                        public_key: pk.to_bytes().to_vec(),
-                    },
-                    secret_key: sk.to_bytes().to_vec(),
-                }
+    pub fn gen(id: u8, kem_id: HpkeKemId) -> Result<Self, DapError> {
+        let kem = match kem_id {
+            HpkeKemId::P256HkdfSha256 => KemAlgorithm::DhKemP256,
+            HpkeKemId::X25519HkdfSha256 => KemAlgorithm::DhKem25519,
+            HpkeKemId::NotImplemented(x) => {
+                return Err(DapError::Fatal(format!("Unsupported KEM ({:?})", x)))
             }
-            HpkeKemId::P256HkdfSha256 => {
-                let (sk, pk) = kem::DhP256HkdfSha256::gen_keypair(&mut rand::thread_rng());
-                HpkeReceiverConfig {
+        };
+        let kdf = KdfAlgorithm::HkdfSha256;
+        let aead = AeadAlgorithm::Aes128Gcm;
+        let generator = Hpke::<ImplHpkeCrypto>::new(Mode::Base, kem, kdf, aead);
+        match generator.generate_key_pair() {
+            Ok(keypair) => {
+                let pk = keypair.public_key();
+                let sk = keypair.private_key();
+                Ok(HpkeReceiverConfig {
                     config: HpkeConfig {
                         id,
                         kem_id,
                         kdf_id: HpkeKdfId::HkdfSha256,
                         aead_id: HpkeAeadId::Aes128Gcm,
-                        public_key: pk.to_bytes().to_vec(),
+                        public_key: Vec::from(pk.as_slice()),
                     },
-                    secret_key: sk.to_bytes().to_vec(),
-                }
-            }
-            _ => {
-                // We should never get here.
-                unreachable!("Unsupported KEM ({:?})", kem_id);
+                    secret_key: Vec::from(sk.as_slice()),
+                })
             }
+            Err(e) => Err(DapError::Fatal(format!(
+                "bad key generation for KEM ({:?}) caused by {:?}",
+                kem_id, e
+            ))),
         }
     }
 
diff --git a/daphne/src/lib.rs b/daphne/src/lib.rs
index eede0e5..6c8fe67 100644
--- a/daphne/src/lib.rs
+++ b/daphne/src/lib.rs
@@ -105,12 +105,6 @@ impl From<VdafError> for DapError {
     }
 }
 
-impl From<::hpke::HpkeError> for DapError {
-    fn from(_e: ::hpke::HpkeError) -> Self {
-        Self::Transition(TransitionFailure::HpkeDecryptError)
-    }
-}
-
 /// DAP aborts.
 #[derive(Debug, thiserror::Error)]
 pub enum DapAbort {
@@ -373,7 +367,7 @@ impl DapGlobalConfig {
     pub fn gen_hpke_receiver_config_list(
         &self,
         first_config_id: u8,
-    ) -> impl IntoIterator<Item = HpkeReceiverConfig> {
+    ) -> impl Iterator<Item = Result<HpkeReceiverConfig, DapError>> {
         assert!(self.supported_hpke_kems.len() <= 256);
         let kem_ids = self.supported_hpke_kems.clone();
         kem_ids.into_iter().enumerate().map(move |(i, kem_id)| {
diff --git a/daphne_worker/Cargo.toml b/daphne_worker/Cargo.toml
index 239fa02..079c50b 100644
--- a/daphne_worker/Cargo.toml
+++ b/daphne_worker/Cargo.toml
@@ -26,7 +26,6 @@ worker = "0.0.11"
 serde_json = "1.0.87"
 getrandom = { version = "0.2.8", features = ["js"] } # Required for prio
 prio = "0.10.0"
-hpke = { version = "0.10.0", features = ["std", "serde_impls"] }
 ring = "0.16.20"
 hex = { version = "0.4.3", features = ["serde"] }
 serde = { version = "1.0.147", features = ["derive"] }
diff --git a/daphne_worker/src/dap.rs b/daphne_worker/src/dap.rs
index 0303436..59196dc 100644
--- a/daphne_worker/src/dap.rs
+++ b/daphne_worker/src/dap.rs
@@ -103,11 +103,11 @@ impl<'srv, D> HpkeDecrypter<'srv> for DaphneWorkerConfig<D> {
             }
 
             let mut hpke_config_id = None;
-            for hpke_receiver_config in self
+            for it in self
                 .global_config
                 .gen_hpke_receiver_config_list(rand::random())
-                .into_iter()
             {
+                let hpke_receiver_config = it.expect("failed to generate HPKE receiver config");
                 if hpke_config_id.is_none() {
                     hpke_config_id = Some(hpke_receiver_config.config.id);
                 }


Test patch:
diff --git a/daphne/src/hpke_test.rs b/daphne/src/hpke_test.rs
index 84f6de0..5404e64 100644
--- a/daphne/src/hpke_test.rs
+++ b/daphne/src/hpke_test.rs
@@ -9,7 +9,7 @@ fn encrypt_roundtrip_x25519_hkdf_sha256() {
     let info = b"info string";
     let aad = b"associated data";
     let plaintext = b"plaintext";
-    let config = HpkeReceiverConfig::gen(23, HpkeKemId::X25519HkdfSha256);
+    let config = HpkeReceiverConfig::gen(23, HpkeKemId::X25519HkdfSha256).unwrap();
     println!("{}", serde_json::to_string(&config).unwrap());
     let (enc, ciphertext) = config.encrypt(info, aad, plaintext).unwrap();
     assert_eq!(
@@ -23,7 +23,7 @@ fn encrypt_roundtrip_p256_hkdf_sha256() {
     let info = b"info string";
     let aad = b"associated data";
     let plaintext = b"plaintext";
-    let config = HpkeReceiverConfig::gen(23, HpkeKemId::P256HkdfSha256);
+    let config = HpkeReceiverConfig::gen(23, HpkeKemId::P256HkdfSha256).unwrap();
     println!("{}", serde_json::to_string(&config).unwrap());
     let (enc, ciphertext) = config.encrypt(info, aad, plaintext).unwrap();
     assert_eq!(
diff --git a/daphne/src/roles_test.rs b/daphne/src/roles_test.rs
index c87b529..09dec78 100644
--- a/daphne/src/roles_test.rs
+++ b/daphne/src/roles_test.rs
@@ -84,7 +84,7 @@ impl Test {
         let helper_url = Url::parse("http://helper.com:8788/v02/").unwrap();
         let time_precision = 3600;
         let collector_hpke_receiver_config =
-            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256);
+            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256).unwrap();
 
         // Create the task list.
         let time_interval_task_id = Id(rng.gen());
@@ -147,8 +147,8 @@ impl Test {
 
         let leader_hpke_receiver_config_list = global_config
             .gen_hpke_receiver_config_list(rng.gen())
-            .into_iter()
-            .collect();
+            .collect::<Result<Vec<HpkeReceiverConfig>, _>>()
+            .expect("failed to generate HPKE receiver config");
         let leader = MockAggregator {
             now,
             global_config: global_config.clone(),
@@ -166,8 +166,8 @@ impl Test {
 
         let helper_hpke_receiver_config_list = global_config
             .gen_hpke_receiver_config_list(rng.gen())
-            .into_iter()
-            .collect();
+            .collect::<Result<Vec<HpkeReceiverConfig>, _>>()
+            .expect("failed to generate HPKE receiver config");
         let helper = MockAggregator {
             now,
             global_config,
diff --git a/daphne/src/vdaf/mod_test.rs b/daphne/src/vdaf/mod_test.rs
index f8f8b75..55f704c 100644
--- a/daphne/src/vdaf/mod_test.rs
+++ b/daphne/src/vdaf/mod_test.rs
@@ -602,11 +602,11 @@ impl<'a> Test<'a> {
         let agg_job_id = Id(rng.gen());
         let vdaf_verify_key = vdaf.gen_verify_key();
         let leader_hpke_receiver_config =
-            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256);
+            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256).unwrap();
         let helper_hpke_receiver_config =
-            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256);
+            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256).unwrap();
         let collector_hpke_receiver_config =
-            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256);
+            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256).unwrap();
         let leader_hpke_config = leader_hpke_receiver_config.clone().config;
         let helper_hpke_config = helper_hpke_receiver_config.clone().config;
         let collector_hpke_config = collector_hpke_receiver_config.clone().config;
diff --git a/daphne_worker_test/tests/test_runner.rs b/daphne_worker_test/tests/test_runner.rs
index 954c86c..b3765d2 100644
--- a/daphne_worker_test/tests/test_runner.rs
+++ b/daphne_worker_test/tests/test_runner.rs
@@ -103,7 +103,7 @@ impl TestRunner {
         };
 
         let collector_hpke_receiver =
-            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256);
+            HpkeReceiverConfig::gen(rng.gen(), HpkeKemId::X25519HkdfSha256).unwrap();
 
         let task_config = DapTaskConfig {
             version: version,