A builder’s field guide to Hybrid Public Key Encryption in Go 1.26 — no PhD required
Every time I wire two internal services together, I hit the same wall. Service A needs to send Service B something confidential. My options have always been:
- A shared API token — a long-term secret sitting in two places, doubling the chance it leaks.
- Mutual TLS — certificates, a CA, rotation, the whole ops tax.
Both work. Both are heavier than the problem deserves. What I actually want is simple: A sends B a message only B can open, and B can trust it came through the right channel — without either side holding a shared secret.
Go 1.26 recently promoted HPKE to a first-class standard-library package: crypto/hpke. It implements Hybrid Public Key Encryption (RFC 9180). I spent a weekend with it, and the craft of it is beautiful. Let me document it the way I wish someone had shown me — from zero, with the math explained like you remember linear algebra, and a runnable demo at the end.
(This article was co-authored with https://liteagent.cloud/ . Try it today!)
Press enter or click to view image in full size