Add MLKEM1024-P384 hybrid KEM support in HPKE

docs/hazmat/primitives/hpke.rst

@@ -110,6 +110,13 @@ specifying auxiliary authenticated information.
         Public and private keys are :class:`MLKEM768X25519PublicKey` and
         :class:`MLKEM768X25519PrivateKey`.
 
+    .. attribute:: MLKEM1024_P384
+
+        A hybrid KEM combining ML-KEM-1024 with P-384. Post-quantum secure.
+        Only available on backends that support ML-KEM. Public and private
+        keys are :class:`MLKEM1024P384PublicKey` and
+        :class:`MLKEM1024P384PrivateKey`.
+
 .. class:: MLKEM768X25519PrivateKey(mlkem_key, x25519_key)
 
     .. versionadded:: 47.0.0
@@ -148,6 +155,44 @@ specifying auxiliary authenticated information.
     :param x25519_key: The X25519 public key component.
     :type x25519_key: :class:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey`
 
+.. class:: MLKEM1024P384PrivateKey(mlkem_key, p384_key)
+
+    .. versionadded:: 47.0.0
+
+    A hybrid ML-KEM-1024 / P-384 private key for use with
+    :attr:`KEM.MLKEM1024_P384`. Combines an
+    :class:`~cryptography.hazmat.primitives.asymmetric.mlkem.MLKEM1024PrivateKey`
+    and an
+    :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`
+    on the SECP384R1 curve into a single recipient key.
+
+    :param mlkem_key: The ML-KEM-1024 private key component.
+    :type mlkem_key: :class:`~cryptography.hazmat.primitives.asymmetric.mlkem.MLKEM1024PrivateKey`
+
+    :param p384_key: The P-384 private key component.
+    :type p384_key: :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`
+
+    .. method:: public_key()
+
+        :returns: :class:`MLKEM1024P384PublicKey`
+
+.. class:: MLKEM1024P384PublicKey(mlkem_key, p384_key)
+
+    .. versionadded:: 47.0.0
+
+    A hybrid ML-KEM-1024 / P-384 public key for use with
+    :attr:`KEM.MLKEM1024_P384`. Combines an
+    :class:`~cryptography.hazmat.primitives.asymmetric.mlkem.MLKEM1024PublicKey`
+    and an
+    :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`
+    on the SECP384R1 curve into a single recipient key.
+
+    :param mlkem_key: The ML-KEM-1024 public key component.
+    :type mlkem_key: :class:`~cryptography.hazmat.primitives.asymmetric.mlkem.MLKEM1024PublicKey`
+
+    :param p384_key: The P-384 public key component.
+    :type p384_key: :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`
+
 .. class:: KDF
 
     An enumeration of key derivation functions.

src/cryptography/hazmat/bindings/_rust/openssl/hpke.pyi

@@ -13,6 +13,7 @@ class KEM:
     MLKEM768: KEM
     MLKEM1024: KEM
     MLKEM768_X25519: KEM
+    MLKEM1024_P384: KEM
 
 class KDF:
     HKDF_SHA256: KDF
@@ -41,6 +42,21 @@ class MLKEM768X25519PublicKey:
         x25519_key: x25519.X25519PublicKey,
     ) -> None: ...
 
+class MLKEM1024P384PrivateKey:
+    def __init__(
+        self,
+        mlkem_key: mlkem.MLKEM1024PrivateKey,
+        p384_key: ec.EllipticCurvePrivateKey,
+    ) -> None: ...
+    def public_key(self) -> MLKEM1024P384PublicKey: ...
+
+class MLKEM1024P384PublicKey:
+    def __init__(
+        self,
+        mlkem_key: mlkem.MLKEM1024PublicKey,
+        p384_key: ec.EllipticCurvePublicKey,
+    ) -> None: ...
+
 class Suite:
     def __init__(self, kem: KEM, kdf: KDF, aead: AEAD) -> None: ...
     def encrypt(
@@ -50,7 +66,8 @@ class Suite:
         | ec.EllipticCurvePublicKey
         | mlkem.MLKEM768PublicKey
         | mlkem.MLKEM1024PublicKey
-        | MLKEM768X25519PublicKey,
+        | MLKEM768X25519PublicKey
+        | MLKEM1024P384PublicKey,
         info: Buffer | None = None,
     ) -> bytes: ...
     def decrypt(
@@ -60,7 +77,8 @@ class Suite:
         | ec.EllipticCurvePrivateKey
         | mlkem.MLKEM768PrivateKey
         | mlkem.MLKEM1024PrivateKey
-        | MLKEM768X25519PrivateKey,
+        | MLKEM768X25519PrivateKey
+        | MLKEM1024P384PrivateKey,
         info: Buffer | None = None,
     ) -> bytes: ...
 
@@ -71,7 +89,8 @@ def _encrypt_with_aad(
     | ec.EllipticCurvePublicKey
     | mlkem.MLKEM768PublicKey
     | mlkem.MLKEM1024PublicKey
-    | MLKEM768X25519PublicKey,
+    | MLKEM768X25519PublicKey
+    | MLKEM1024P384PublicKey,
     info: Buffer | None = None,
     aad: Buffer | None = None,
 ) -> bytes: ...
@@ -82,7 +101,8 @@ def _decrypt_with_aad(
     | ec.EllipticCurvePrivateKey
     | mlkem.MLKEM768PrivateKey
     | mlkem.MLKEM1024PrivateKey
-    | MLKEM768X25519PrivateKey,
+    | MLKEM768X25519PrivateKey
+    | MLKEM1024P384PrivateKey,
     info: Buffer | None = None,
     aad: Buffer | None = None,
 ) -> bytes: ...

src/cryptography/hazmat/primitives/hpke.py

@@ -11,6 +11,8 @@
 KEM = rust_openssl.hpke.KEM
 MLKEM768X25519PrivateKey = rust_openssl.hpke.MLKEM768X25519PrivateKey
 MLKEM768X25519PublicKey = rust_openssl.hpke.MLKEM768X25519PublicKey
+MLKEM1024P384PrivateKey = rust_openssl.hpke.MLKEM1024P384PrivateKey
+MLKEM1024P384PublicKey = rust_openssl.hpke.MLKEM1024P384PublicKey
 Suite = rust_openssl.hpke.Suite
 
 __all__ = [
@@ -19,5 +21,7 @@
     "KEM",
     "MLKEM768X25519PrivateKey",
     "MLKEM768X25519PublicKey",
+    "MLKEM1024P384PrivateKey",
+    "MLKEM1024P384PublicKey",
     "Suite",
 ]