3. Notation

3. Notation

The following terms are used throughout this document to describe the operations, roles, and behaviors of HPKE:

(skX, pkX): A key encapsulation mechanism (KEM) key pair used in role X, where X is one of S, R, or E as sender, recipient, and ephemeral, respectively; skX is the private key and pkX is the public key.

pk(skX): The KEM public key corresponding to the KEM private key skX.

Sender (S): Role of entity that sends an encrypted message.

Recipient (R): Role of entity that receives an encrypted message.

Ephemeral (E): Role of a fresh random value meant for one-time use.

I2OSP(n, w): Convert non-negative integer n to a w-length, big-endian byte string, as described in [RFC8017].

OS2IP(x): Convert byte string x to a non-negative integer, as described in [RFC8017], assuming big-endian byte order.

concat(x0, ..., xN): Concatenation of byte strings. concat(0x01, 0x0203, 0x040506) = 0x010203040506.

random(n): A pseudorandom byte string of length n bytes.

xor(a,b): XOR of byte strings; xor(0xF0F0, 0x1234) = 0xE2C4. It is an error to call this function with two arguments of unequal length.