Hybrid Public Key Encryption

Overview

Hybrid public key encryption (HPKE), specified in RFC 9180, is the scheme MEK-MPA uses to encapsulate the secrets that enable access to encrypted storage. Encapsulation requires an asymmetric KEM public key, represented as an encapsulation key linked to the certificates table; certificate-chain support is provided through a next-certificate link. HPKE combines three algorithms — a KEM (the asymmetric algorithm used to transmit a shared secret), a key derivation function that expands the shared secret into an encryption key, and an encryption algorithm that seals and unseals device data — all defined in an X.509 certificate extension for the loaded public key.

As of the 2025 OCP Global Summit storage talk, the HPKE code points needed for post-quantum support were not yet fully baked in the IETF — estimated a couple of months out — making X.509 certificate handling for the larger post-quantum keys a moving target, with possible TCG packet-size limits that vendors can adjust in the properties table.