<!--
{
  "availability" : [
    "iOS: 17.0.0 -",
    "iPadOS: 17.0.0 -",
    "macCatalyst: 17.0.0 -",
    "macOS: 14.0.0 -",
    "tvOS: 17.0.0 -",
    "visionOS: 1.0.0 -",
    "watchOS: 10.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "CryptoKit",
  "identifier" : "/documentation/CryptoKit/HPKE/Ciphersuite",
  "metadataVersion" : "0.1.0",
  "role" : "Structure",
  "symbol" : {
    "kind" : "Structure",
    "modules" : [
      "Apple CryptoKit",
      "CryptoKit"
    ],
    "preciseIdentifier" : "s:9CryptoKit4HPKEO11CiphersuiteV"
  },
  "title" : "HPKE.Ciphersuite"
}
-->

# HPKE.Ciphersuite

Cipher suites to use in hybrid public key encryption (HPKE).

```
struct Ciphersuite
```

## Overview

HPKE cipher suites identify the authenticated encryption with additional data (AEAD) algorithm for encrypting
and decrypting messages, the key derivation function (KDF) for deriving the shared key, and the key encapsulation
mechanism (KEM) for sharing the symmetric key. The sender and recipient of encrypted messages need to use the
same cipher suite.

## Topics

### Using post-quantum cipher suites

[`static let XWingMLKEM768X25519_SHA256_AES_GCM_256: HPKE.Ciphersuite`](/documentation/CryptoKit/HPKE/Ciphersuite/XWingMLKEM768X25519_SHA256_AES_GCM_256)

A cipher suite for HPKE that uses the X-Wing KEM (ML-KEM-768 with X25519), SHA-2 key derivation
with a 256-bit digest, and the Advanced Encryption Standard cipher in Galois/Counter Mode with a key length of 256 bits.

### Using elliptic curve cipher suites

[`static let Curve25519_SHA256_ChachaPoly: HPKE.Ciphersuite`](/documentation/CryptoKit/HPKE/Ciphersuite/Curve25519_SHA256_ChachaPoly)

A cipher suite for HPKE that uses X25519 elliptic curve key agreement, SHA-2 key derivation
with a 256-bit digest, and the ChaCha20 stream cipher with the Poly1305 message authentication code.

[`static let P256_SHA256_AES_GCM_256: HPKE.Ciphersuite`](/documentation/CryptoKit/HPKE/Ciphersuite/P256_SHA256_AES_GCM_256)

A cipher suite for HPKE that uses NIST P-256 elliptic curve key agreement, SHA-2 key derivation
with a 256-bit digest, and the Advanced Encryption Standard cipher in Galois/Counter Mode with a key length of 256 bits.

[`static let P384_SHA384_AES_GCM_256: HPKE.Ciphersuite`](/documentation/CryptoKit/HPKE/Ciphersuite/P384_SHA384_AES_GCM_256)

A cipher suite that you use for HPKE using NIST P-384 elliptic curve key agreement, SHA-2 key derivation
with a 384-bit digest, and the Advanced Encryption Standard cipher in Galois/Counter Mode with a key length of 256 bits.

[`static let P521_SHA512_AES_GCM_256: HPKE.Ciphersuite`](/documentation/CryptoKit/HPKE/Ciphersuite/P521_SHA512_AES_GCM_256)

A cipher suite for HPKE that uses NIST P-521 elliptic curve key agreement, SHA-2 key derivation
with a 512-bit digest, and the Advanced Encryption Standard cipher in Galois/Counter Mode with a key length of 256 bits.

### Creating a cipher suite

[`init(kem: HPKE.KEM, kdf: HPKE.KDF, aead: HPKE.AEAD)`](/documentation/CryptoKit/HPKE/Ciphersuite/init(kem:kdf:aead:))

Creates an HPKE cipher suite.

### Inspecting a cipher suite

[`let aead: HPKE.AEAD`](/documentation/CryptoKit/HPKE/Ciphersuite/aead)

The authenticated encryption with additional data (AEAD) algorithm for encrypting and decrypting messages.

[`let kdf: HPKE.KDF`](/documentation/CryptoKit/HPKE/Ciphersuite/kdf)

The key derivation function (KDF) for deriving the symmetric key.

[`let kem: HPKE.KEM`](/documentation/CryptoKit/HPKE/Ciphersuite/kem)

The key encapsulation mechanism (KEM) for encapsulating the symmetric key.

## Relationships

### Conforms To

[`Sendable`](/documentation/Swift/Sendable)

[`SendableMetatype`](/documentation/Swift/SendableMetatype)

---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)