Exporting private keys

import {CipherSuite, DhkemP256HkdfSha256, HkdfSha256} from '@hpke/core';
import {Chacha20Poly1305} from '@hpke/chacha20poly1305';

/**
 * Decrypts a message using HPKE (Hybrid Public Key Encryption).
 *
 * Uses P-256 keys with HPKE to decrypt an encrypted message. The function expects base64-encoded
 * inputs and handles all necessary key imports and context creation for HPKE decryption.
 *
 * @param privateKeyBase64 Base64-encoded private key in PKCS8 format used for decryption.
 * @param encapsulatedKeyBase64 Base64-encoded raw public key bytes representing the
 *     encapsulated key.
 * @param ciphertextBase64 Base64-encoded encrypted message using base64url encoding that
 *     will be decrypted.
 * @returns A Promise that resolves to the decrypted message as a UTF-8 string.
 * @throws {Error} If decryption fails or if any of the inputs are incorrectly formatted.
 */
async function decryptHPKEMessage(
  privateKeyBase64: string,
  encapsulatedKeyBase64: string,
  ciphertextBase64: string
): Promise<string> {
  // Initialize the cipher suite
  const suite = new CipherSuite({
    kem: new DhkemP256HkdfSha256(),
    kdf: new HkdfSha256(),
    aead: new Chacha20Poly1305()
  });

  // Convert base64 to ArrayBuffer using browser APIs
  const base64ToBuffer = (base64: string) =>
    Uint8Array.from(atob(base64), (c) => c.charCodeAt(0)).buffer;

  // Import private key using WebCrypto
  const privateKey = await crypto.subtle.importKey(
    'pkcs8',
    base64ToBuffer(privateKeyBase64),
    {
      name: 'ECDH',
      namedCurve: 'P-256'
    },
    true,
    ['deriveKey', 'deriveBits']
  );

  // Create recipient context and decrypt
  const recipient = await suite.createRecipientContext({
    recipientKey: privateKey,
    enc: base64ToBuffer(encapsulatedKeyBase64)
  });

  return new TextDecoder().decode(await recipient.open(base64ToBuffer(ciphertextBase64)));
}

from cryptography.hazmat.primitives import serialization
from hpke import CipherSuite, KEMId, KDFId, AEADId
import base64

async def decrypt_hpke_message(
    private_key_base64: str,
    encapsulated_key_base64: str,
    ciphertext_base64: str
) -> str:
    """
    Decrypts a message using HPKE (Hybrid Public Key Encryption) with P-256 keys

    Args:
        private_key_base64: Base64-encoded private key in PKCS8 format used for decryption.
        encapsulated_key_base64: Base64-encoded raw public key bytes representing the
                                encapsulated key.
        ciphertext_base64: Base64-encoded encrypted message using base64url encoding that
                          will be decrypted.

    Returns:
        str: The decrypted message as a UTF-8 string

    Raises:
        ValueError: If decryption fails or if inputs are incorrectly formatted
    """
    # Initialize the cipher suite
    suite = CipherSuite.new(
        KEMId.DHKEM_P256_HKDF_SHA256,
        KDFId.HKDF_SHA256,
        AEADId.CHACHA20_POLY1305
    )

    # Convert base64 to bytes
    raw_public_key = base64.b64decode(encapsulated_key_base64)
    private_key_bytes = base64.b64decode(private_key_base64)
    ciphertext = base64.b64decode(ciphertext_base64)

    # Import private key
    loaded_private_key = serialization.load_der_private_key(
        private_key_bytes,
        password=None
    )
    private_number = loaded_private_key.private_numbers().private_value
    private_bytes = private_number.to_bytes(32, byteorder="big")  # P-256 uses 32 bytes
    private_kem_key = suite.kem.deserialize_private_key(private_bytes)

    # Create recipient context and decrypt
    encapsulated_kem_key = suite.kem.deserialize_public_key(raw_public_key)
    recipient_context = suite.create_recipient_context(
        encapsulated_kem_key.to_public_bytes(),
        private_kem_key
    )

    # Decrypt and return as UTF-8 string
    return recipient_context.open(ciphertext).decode("utf-8")