---
name: "gnutls_hpke_decap"
section: "3"
platform: "linux"
package: "gnutls"
version: "3.8.13-3"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/gnutls_hpke_decap"
---

# gnutls\_hpke\_decap(3)

API function

## NAME

gnutls\_hpke\_decap - API function

## SYNOPSIS

**#include \<gnutls/hpke.h\>**

**int gnutls\_hpke\_decap(gnutls\_hpke\_context\_t** *ctx***, const gnutls\_datum\_t \*** *info***, const gnutls\_datum\_t \*** *enc***, const gnutls\_privkey\_t** *receiver\_privkey***, const gnutls\_pubkey\_t** *sender\_pubkey***, const gnutls\_datum\_t \*** *psk***, const gnutls\_datum\_t \*** *psk\_id***);**

## ARGUMENTS

- gnutls\_hpke\_context\_t ctx

  The HPKE context to use for decapsulation.

- const gnutls\_datum\_t \* info

  The application-specific information that was included in the key schedule (optional).

- const gnutls\_datum\_t \* enc

  A pointer to a gnutls\_datum\_t structure containing the encapsulated key received from the sender.

- const gnutls\_privkey\_t receiver\_privkey

  The receiver's private key to use for decapsulation.

- const gnutls\_pubkey\_t sender\_pubkey

  The sender's public key for AuthDecap operation (optional).

- const gnutls\_datum\_t \* psk

  The pre-shared key (optional).

- const gnutls\_datum\_t \* psk\_id

  The pre-shared key identifier (optional).

## DESCRIPTION

This function performs the decapsulation operation of HPKE. It takes the encapsulated key ( *enc* ) received from the sender and uses it along with the receiver's private key to derive the shared secret. It then uses this shared secret along with any provided application-specific information ( *info* ) to set up the necessary keys and nonces in the HPKE context for subsequent sealing and opening operations.

This function must be used once per HPKE context and before any calls to **gnutls\_hpke\_open()**.

 *enc* should be the same encapsulated key that was generated by **gnutls\_hpke\_encap()** on the sender's side.

 *receiver\_privkey* must be a valid private key that is compatible with the KEM algorithm specified in the HPKE context and that corresponds to the receiver's public key used during encapsulation.

For **GNUTLS\_HPKE\_MODE\_AUTH** or **GNUTLS\_HPKE\_MODE\_AUTH\_PSK**,\
  *sender\_pubkey* must be a valid public key that can be used for authentication. For **GNUTLS\_HPKE\_MODE\_PSK** or **GNUTLS\_HPKE\_MODE\_AUTH\_PSK**, a pre-shared key ( *psk* ) and its identifier ( *psk\_id* ) must be supplied.

## RETURNS

0 on success, or a negative error code on failure

## SINCE

3\.8.13

## REPORTING BUGS

Report bugs to \<bugs@gnutls.org\>.\
 Home page: https://www.gnutls.org

## COPYRIGHT

Copyright © 2001-2023 Free Software Foundation, Inc., and others.\
 Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved.

## SEE ALSO

The full documentation for **gnutls** is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form visit

- https://www.gnutls.org/manual/