tests/hpke-tests.c - master - githubmirror/gnutls

tests/hpke-tests.c
3 426 строк123 KB
Daiki Ueno
hpke: rename gnutls_hpke_generate_keypair to _derive_keypair
26 апр 2026, 03:58
26 апр 2026, 03:58f00448f
/*
 * Copyright © 2025 David Dudas
 *
 * Author: David Dudas <david.dudas03@e-uvt.ro>
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *
 */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include <gnutls/gnutls.h>
#include <gnutls/crypto.h>
#include <gnutls/hpke.h>
#include <gnutls/abstract.h>

#include "utils.h"

#include <stdbool.h>
#include <stdint.h>

extern int _gnutls_hpke_get_seq(gnutls_hpke_context_t ctx, uint64_t *seq);
extern int _gnutls_hpke_set_ikme(gnutls_hpke_context_t ctx,
				 const gnutls_datum_t *ikme);

static unsigned char info[] = { 0x4f, 0x64, 0x65, 0x20, 0x6f, 0x6e, 0x20,
				0x61, 0x20, 0x47, 0x72, 0x65, 0x63, 0x69,
				0x61, 0x6e, 0x20, 0x55, 0x72, 0x6e };

static unsigned char plaintext[] = { 0x42, 0x65, 0x61, 0x75, 0x74, 0x79,
				     0x20, 0x69, 0x73, 0x20, 0x74, 0x72,
				     0x75, 0x74, 0x68, 0x2c, 0x20, 0x74,
				     0x72, 0x75, 0x74, 0x68, 0x20, 0x62,
				     0x65, 0x61, 0x75, 0x74, 0x79 };

static unsigned char seq0_aad[] = { 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2d, 0x30 };

static unsigned char seq1_aad[] = { 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2d, 0x31 };

static unsigned char seq2_aad[] = { 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x2d, 0x32 };

static unsigned char exporter_context_1[] = {};

static unsigned char exporter_context_2[] = { 0x00 };

static unsigned char exporter_context_3[] = { 0x54, 0x65, 0x73, 0x74,
					      0x43, 0x6f, 0x6e, 0x74,
					      0x65, 0x78, 0x74 };

static unsigned char psk[] = { 0x02, 0x47, 0xfd, 0x33, 0xb9, 0x13, 0x76, 0x0f,
			       0xa1, 0xfa, 0x51, 0xe1, 0x89, 0x2d, 0x9f, 0x30,
			       0x7f, 0xbe, 0x65, 0xeb, 0x17, 0x1e, 0x81, 0x32,
			       0xc2, 0xaf, 0x18, 0x55, 0x5a, 0x73, 0x8b, 0x82 };

static unsigned char psk_id[] = { 0x45, 0x6e, 0x6e, 0x79, 0x6e, 0x20,
				  0x44, 0x75, 0x72, 0x69, 0x6e, 0x20,
				  0x61, 0x72, 0x61, 0x6e, 0x20, 0x4d,
				  0x6f, 0x72, 0x69, 0x61 };

typedef struct hpke_test_encryption_parameters_st {
	size_t sequence_number;
	gnutls_datum_t plaintext;
	gnutls_datum_t aad;
	gnutls_datum_t expected_ciphertext;
} hpke_test_encryption_parameters_st;

typedef struct hpke_test_exporter_parameters_st {
	gnutls_datum_t exporter_context;
	size_t exporter_length;
	gnutls_datum_t expected_exporter_value;
} hpke_test_exporter_parameters_st;

typedef struct hpke_test_parameters_st {
	gnutls_hpke_mode_t mode;
	gnutls_hpke_kem_t kem;
	gnutls_hpke_kdf_t kdf;
	gnutls_hpke_aead_t aead;
	gnutls_datum_t ikmE;
	gnutls_datum_t ikmR;
	gnutls_datum_t *ikmS;
	gnutls_datum_t info;
	gnutls_datum_t *psk;
	gnutls_datum_t *psk_id;
	gnutls_datum_t expected_enc;
	hpke_test_encryption_parameters_st *encryption_parameters;
	size_t num_encryption_parameters;
	hpke_test_exporter_parameters_st *exporter_parameters;
	size_t num_exporter_parameters;
} hpke_test_parameters_st;

static void test_hpke(const hpke_test_parameters_st *params)
{
	int ret;
	gnutls_privkey_t skR = NULL;
	gnutls_pubkey_t pkR = NULL;
	gnutls_privkey_t skS = NULL;
	gnutls_pubkey_t pkS = NULL;

	gnutls_hpke_context_t sender_ctx = NULL;
	gnutls_hpke_context_t receiver_ctx = NULL;

	gnutls_datum_t enc = { NULL, 0 };
	gnutls_datum_t plaintext_out = { NULL, 0 };
	gnutls_datum_t ciphertext_out = { NULL, 0 };
	gnutls_datum_t exporter_out = { NULL, 0 };

	ret = gnutls_hpke_init(&sender_ctx, params->mode,
			       GNUTLS_HPKE_ROLE_SENDER, params->kem,
			       params->kdf, params->aead);
	if (ret < 0) {
		fail("gnutls_hpke_init (mode: %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
		     params->mode, params->kem, params->kdf, params->aead,
		     gnutls_strerror(ret));
	}

	ret = _gnutls_hpke_set_ikme(sender_ctx, &params->ikmE);
	if (ret < 0) {
		fail("_gnutls_hpke_set_ikme (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
		     params->mode, params->kem, params->kdf, params->aead,
		     gnutls_strerror(ret));
	}

	if (params->ikmS != NULL) {
		ret = gnutls_privkey_init(&skS);
		if (ret < 0) {
			fail("gnutls_privkey_init: %s\n", gnutls_strerror(ret));
		}
		ret = gnutls_pubkey_init(&pkS);
		if (ret < 0) {
			fail("gnutls_pubkey_init: %s\n", gnutls_strerror(ret));
		}
		ret = gnutls_hpke_derive_keypair(params->kem, params->ikmS, skS,
						 pkS);
		if (ret < 0) {
			fail("gnutls_hpke_derive_keypair (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
			     params->mode, params->kem, params->kdf,
			     params->aead, gnutls_strerror(ret));
		}
	}

	ret = gnutls_privkey_init(&skR);
	if (ret < 0) {
		fail("gnutls_privkey_init: %s\n", gnutls_strerror(ret));
	}
	ret = gnutls_pubkey_init(&pkR);
	if (ret < 0) {
		fail("gnutls_pubkey_init: %s\n", gnutls_strerror(ret));
	}
	ret = gnutls_hpke_derive_keypair(params->kem, &params->ikmR, skR, pkR);
	if (ret < 0) {
		fail("gnutls_hpke_derive_keypair (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
		     params->mode, params->kem, params->kdf, params->aead,
		     gnutls_strerror(ret));
	}

	ret = gnutls_hpke_encap(sender_ctx, &params->info, &enc, pkR, skS,
				params->psk, params->psk_id);
	if (ret < 0) {
		fail("gnutls_hpke_encap (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
		     params->mode, params->kem, params->kdf, params->aead,
		     gnutls_strerror(ret));
	}

	if (params->expected_enc.size != enc.size ||
	    memcmp(params->expected_enc.data, enc.data, enc.size) != 0) {
		fail("enc does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
		     params->mode, params->kem, params->kdf, params->aead);
	}

	ret = gnutls_hpke_init(&receiver_ctx, params->mode,
			       GNUTLS_HPKE_ROLE_RECEIVER, params->kem,
			       params->kdf, params->aead);
	if (ret < 0) {
		fail("gnutls_context_init (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
		     params->mode, params->kem, params->kdf, params->aead,
		     gnutls_strerror(ret));
	}

	ret = gnutls_hpke_decap(receiver_ctx, &params->info, &enc, skR, pkS,
				params->psk, params->psk_id);
	if (ret < 0) {
		fail("gnutls_hpke_decap (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
		     params->mode, params->kem, params->kdf, params->aead,
		     gnutls_strerror(ret));
	}

	for (size_t i = 0; i < params->num_encryption_parameters; i++) {
		hpke_test_encryption_parameters_st *enc_params =
			&params->encryption_parameters[i];
		ret = gnutls_hpke_seal(sender_ctx, &enc_params->aad,
				       &enc_params->plaintext, &ciphertext_out);
		if (ret < 0) {
			fail("gnutls_hpke_seal (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
			     params->mode, params->kem, params->kdf,
			     params->aead, gnutls_strerror(ret));
		}

		if (enc_params->expected_ciphertext.size !=
			    ciphertext_out.size ||
		    memcmp(enc_params->expected_ciphertext.data,
			   ciphertext_out.data, ciphertext_out.size) != 0) {
			fail("ciphertext does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
			     params->mode, params->kem, params->kdf,
			     params->aead);
		}

		ret = gnutls_hpke_open(receiver_ctx, &enc_params->aad,
				       &ciphertext_out, &plaintext_out);
		if (ret < 0) {
			fail("gnutls_hpke_open (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
			     params->mode, params->kem, params->kdf,
			     params->aead, gnutls_strerror(ret));
		}

		if (enc_params->plaintext.size != plaintext_out.size ||
		    memcmp(enc_params->plaintext.data, plaintext_out.data,
			   plaintext_out.size) != 0) {
			fail("decrypted plaintext does not match original plaintext (mode %d, kem: %d, kdf: %d, aead: %d)\n",
			     params->mode, params->kem, params->kdf,
			     params->aead);
		}

		uint64_t seq;
		ret = _gnutls_hpke_get_seq(receiver_ctx, &seq);
		if (ret < 0) {
			fail("_gnutls_hpke_get_seq (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
			     params->mode, params->kem, params->kdf,
			     params->aead, gnutls_strerror(ret));
		}

		if (seq != enc_params->sequence_number + 1) {
			fail("sequence number does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
			     params->mode, params->kem, params->kdf,
			     params->aead);
		}

		gnutls_free(ciphertext_out.data);
		ciphertext_out.data = NULL;
		gnutls_free(plaintext_out.data);
		plaintext_out.data = NULL;
	}

	for (size_t i = 0; i < params->num_exporter_parameters; i++) {
		hpke_test_exporter_parameters_st *exp_params =
			&params->exporter_parameters[i];
		ret = gnutls_hpke_export(sender_ctx,
					 &exp_params->exporter_context, 32,
					 &exporter_out);
		if (ret < 0) {
			fail("gnutls_hpke_export (mode %d, kem: %d, kdf: %d, aead: %d) failed: %s\n",
			     params->mode, params->kem, params->kdf,
			     params->aead, gnutls_strerror(ret));
		}

		if (exp_params->expected_exporter_value.size !=
			    exporter_out.size ||
		    memcmp(exp_params->expected_exporter_value.data,
			   exporter_out.data, exporter_out.size) != 0) {
			fail("exported value does not match expected value (mode %d, kem: %d, kdf: %d, aead: %d)\n",
			     params->mode, params->kem, params->kdf,
			     params->aead);
		}

		gnutls_free(exporter_out.data);
		exporter_out.data = NULL;
	}

	gnutls_privkey_deinit(skR);
	gnutls_pubkey_deinit(pkR);
	gnutls_privkey_deinit(skS);
	gnutls_pubkey_deinit(pkS);
	gnutls_hpke_deinit(sender_ctx);
	gnutls_hpke_deinit(receiver_ctx);

	gnutls_free(enc.data);
	gnutls_free(plaintext_out.data);
	gnutls_free(ciphertext_out.data);
	gnutls_free(exporter_out.data);
}

static void rfc9180_a11(void)
{
	unsigned char a111_seq0_expected_ct[] = {
		0xf9, 0x38, 0x55, 0x8b, 0x5d, 0x72, 0xf1, 0xa2, 0x38,
		0x10, 0xb4, 0xbe, 0x2a, 0xb4, 0xf8, 0x43, 0x31, 0xac,
		0xc0, 0x2f, 0xc9, 0x7b, 0xab, 0xc5, 0x3a, 0x52, 0xae,
		0x82, 0x18, 0xa3, 0x55, 0xa9, 0x6d, 0x87, 0x70, 0xac,
		0x83, 0xd0, 0x7b, 0xea, 0x87, 0xe1, 0x3c, 0x51, 0x2a
	};

	unsigned char a111_seq1_expected_ct[] = {
		0xaf, 0x2d, 0x7e, 0x9a, 0xc9, 0xae, 0x7e, 0x27, 0x0f,
		0x46, 0xba, 0x1f, 0x97, 0x5b, 0xe5, 0x3c, 0x09, 0xf8,
		0xd8, 0x75, 0xbd, 0xc8, 0x53, 0x54, 0x58, 0xc2, 0x49,
		0x4e, 0x8a, 0x6e, 0xab, 0x25, 0x1c, 0x03, 0xd0, 0xc2,
		0x2a, 0x56, 0xb8, 0xca, 0x42, 0xc2, 0x06, 0x3b, 0x84
	};

	unsigned char a111_seq2_expected_ct[] = {
		0x49, 0x8d, 0xfc, 0xab, 0xd9, 0x2e, 0x8a, 0xce, 0xdc,
		0x28, 0x1e, 0x85, 0xaf, 0x1c, 0xb4, 0xe3, 0xe3, 0x1c,
		0x7d, 0xc3, 0x94, 0xa1, 0xca, 0x20, 0xe1, 0x73, 0xcb,
		0x72, 0x51, 0x64, 0x91, 0x58, 0x8d, 0x96, 0xa1, 0x9a,
		0xd4, 0xa6, 0x83, 0x51, 0x89, 0x73, 0xdc, 0xc1, 0x80
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { a111_seq0_expected_ct,
					   sizeof(a111_seq0_expected_ct) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { a111_seq1_expected_ct,
					   sizeof(a111_seq1_expected_ct) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { a111_seq2_expected_ct,
					   sizeof(a111_seq2_expected_ct) } }
	};

	unsigned char a112_expected_exporter_value_1[] = {
		0x38, 0x53, 0xfe, 0x2b, 0x40, 0x35, 0x19, 0x5a,
		0x57, 0x3f, 0xfc, 0x53, 0x85, 0x6e, 0x77, 0x05,
		0x8e, 0x15, 0xd9, 0xea, 0x06, 0x4d, 0xe3, 0xe5,
		0x9f, 0x49, 0x61, 0xd0, 0x09, 0x52, 0x50, 0xee
	};

	unsigned char a112_expected_exporter_value_2[] = {
		0x2e, 0x8f, 0x0b, 0x54, 0x67, 0x3c, 0x70, 0x29,
		0x64, 0x9d, 0x4e, 0xb9, 0xd5, 0xe3, 0x3b, 0xf1,
		0x87, 0x2c, 0xf7, 0x6d, 0x62, 0x3f, 0xf1, 0x64,
		0xac, 0x18, 0x5d, 0xa9, 0xe8, 0x8c, 0x21, 0xa5
	};

	unsigned char a112_expected_exporter_value_3[] = {
		0xe9, 0xe4, 0x30, 0x65, 0x10, 0x2c, 0x38, 0x36,
		0x40, 0x1b, 0xed, 0x8c, 0x3c, 0x3c, 0x75, 0xae,
		0x46, 0xbe, 0x16, 0x39, 0x86, 0x93, 0x91, 0xd6,
		0x2c, 0x61, 0xf1, 0xec, 0x7a, 0xf5, 0x49, 0x31
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(a112_expected_exporter_value_1),
		  .expected_exporter_value = { a112_expected_exporter_value_1,
					       sizeof(a112_expected_exporter_value_1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(a112_expected_exporter_value_2),
		  .expected_exporter_value = { a112_expected_exporter_value_2,
					       sizeof(a112_expected_exporter_value_2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(a112_expected_exporter_value_3),
		  .expected_exporter_value = { a112_expected_exporter_value_3,
					       sizeof(a112_expected_exporter_value_3) } }
	};

	unsigned char a11_ikmE[] = { 0x72, 0x68, 0x60, 0x0d, 0x40, 0x3f, 0xce,
				     0x43, 0x15, 0x61, 0xae, 0xf5, 0x83, 0xee,
				     0x16, 0x13, 0x52, 0x7c, 0xff, 0x65, 0x5c,
				     0x13, 0x43, 0xf2, 0x98, 0x12, 0xe6, 0x67,
				     0x06, 0xdf, 0x32, 0x34 };

	unsigned char a11_ikmR[] = { 0x6d, 0xb9, 0xdf, 0x30, 0xaa, 0x07, 0xdd,
				     0x42, 0xee, 0x5e, 0x81, 0x81, 0xaf, 0xdb,
				     0x97, 0x7e, 0x53, 0x8f, 0x5e, 0x1f, 0xec,
				     0x8a, 0x06, 0x22, 0x3f, 0x33, 0xf7, 0x01,
				     0x3e, 0x52, 0x50, 0x37 };

	unsigned char a11_expected_enc[] = { 0x37, 0xfd, 0xa3, 0x56, 0x7b, 0xdb,
					     0xd6, 0x28, 0xe8, 0x86, 0x68, 0xc3,
					     0xc8, 0xd7, 0xe9, 0x7d, 0x1d, 0x12,
					     0x53, 0xb6, 0xd4, 0xea, 0x6d, 0x44,
					     0xc1, 0x50, 0xf7, 0x41, 0xf1, 0xbf,
					     0x44, 0x31 };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_BASE,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { a11_ikmE, sizeof(a11_ikmE) },
		.ikmR = { a11_ikmR, sizeof(a11_ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { a11_expected_enc, sizeof(a11_expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a12(void)
{
	unsigned char a12_seq0_expected_ct[] = {
		0xe5, 0x2c, 0x6f, 0xed, 0x7f, 0x75, 0x8d, 0x0c, 0xf7,
		0x14, 0x56, 0x89, 0xf2, 0x1b, 0xc1, 0xbe, 0x6e, 0xc9,
		0xea, 0x09, 0x7f, 0xef, 0x4e, 0x95, 0x94, 0x40, 0x01,
		0x2f, 0x4f, 0xeb, 0x73, 0xfb, 0x61, 0x1b, 0x94, 0x61,
		0x99, 0xe6, 0x81, 0xf4, 0xcf, 0xc3, 0x4d, 0xb8, 0xea
	};
	unsigned char a12_seq1_expected_ct[] = {
		0x49, 0xf3, 0xb1, 0x9b, 0x28, 0xa9, 0xea, 0x9f, 0x43,
		0xe8, 0xc7, 0x12, 0x04, 0xc0, 0x0d, 0x4a, 0x49, 0x0e,
		0xe7, 0xf6, 0x13, 0x87, 0xb6, 0x71, 0x9d, 0xb7, 0x65,
		0xe9, 0x48, 0x12, 0x3b, 0x45, 0xb6, 0x16, 0x33, 0xef,
		0x05, 0x9b, 0xa2, 0x2c, 0xd6, 0x24, 0x37, 0xc8, 0xba
	};
	unsigned char a12_seq2_expected_ct[] = {
		0x25, 0x7c, 0xa6, 0xa0, 0x84, 0x73, 0xdc, 0x85, 0x1f,
		0xde, 0x45, 0xaf, 0xd5, 0x98, 0xcc, 0x83, 0xe3, 0x26,
		0xdd, 0xd0, 0xab, 0xe1, 0xef, 0x23, 0xba, 0xa3, 0xba,
		0xa4, 0xdd, 0x8c, 0xde, 0x99, 0xfc, 0xe2, 0xc1, 0xe8,
		0xce, 0x68, 0x7b, 0x0b, 0x47, 0xea, 0xd1, 0xad, 0xc9
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { a12_seq0_expected_ct,
					   sizeof(a12_seq0_expected_ct) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { a12_seq1_expected_ct,
					   sizeof(a12_seq1_expected_ct) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { a12_seq2_expected_ct,
					   sizeof(a12_seq2_expected_ct) } }
	};

	unsigned char a12_expected_exporter_value_1[] = {
		0xdf, 0xf1, 0x7a, 0xf3, 0x54, 0xc8, 0xb4, 0x16,
		0x73, 0x56, 0x7d, 0xb6, 0x25, 0x9f, 0xd6, 0x02,
		0x99, 0x67, 0xb4, 0xe1, 0xaa, 0xd1, 0x30, 0x23,
		0xc2, 0xae, 0x5d, 0xf8, 0xf4, 0xf4, 0x3b, 0xf6
	};

	unsigned char a12_expected_exporter_value_2[] = {
		0x6a, 0x84, 0x72, 0x61, 0xd8, 0x20, 0x7f, 0xe5,
		0x96, 0xbe, 0xfb, 0x52, 0x92, 0x84, 0x63, 0x88,
		0x1a, 0xb4, 0x93, 0xda, 0x34, 0x5b, 0x10, 0xe1,
		0xdc, 0xc6, 0x45, 0xe3, 0xb9, 0x4e, 0x2d, 0x95
	};

	unsigned char a12_expected_exporter_value_3[] = {
		0x8a, 0xff, 0x52, 0xb4, 0x5a, 0x1b, 0xe3, 0xa7,
		0x34, 0xbc, 0x7a, 0x41, 0xe2, 0x0b, 0x4e, 0x05,
		0x5a, 0xd4, 0xc4, 0xd2, 0x21, 0x04, 0xb0, 0xc2,
		0x02, 0x85, 0xa7, 0xc4, 0x30, 0x24, 0x01, 0xcd
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(a12_expected_exporter_value_1),
		  .expected_exporter_value = { a12_expected_exporter_value_1,
					       sizeof(a12_expected_exporter_value_1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(a12_expected_exporter_value_2),
		  .expected_exporter_value = { a12_expected_exporter_value_2,
					       sizeof(a12_expected_exporter_value_2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(a12_expected_exporter_value_3),
		  .expected_exporter_value = { a12_expected_exporter_value_3,
					       sizeof(a12_expected_exporter_value_3) } }
	};

	unsigned char ikmE[] = {
		0x78, 0x62, 0x8c, 0x35, 0x4e, 0x46, 0xf3, 0xe1,
		0x69, 0xbd, 0x23, 0x1b, 0xe7, 0xb2, 0xff, 0x1c,
		0x77, 0xaa, 0x30, 0x24, 0x60, 0xa2, 0x6d, 0xbf,
		0xa1, 0x55, 0x15, 0x68, 0x4c, 0x00, 0x13, 0x0b
	};
	unsigned char ikmR[] = {
		0xd4, 0xa0, 0x9d, 0x09, 0xf5, 0x75, 0xfe, 0xf4,
		0x25, 0x90, 0x5d, 0x2a, 0xb3, 0x96, 0xc1, 0x44,
		0x91, 0x41, 0x46, 0x3f, 0x69, 0x8f, 0x8e, 0xfd,
		0xb7, 0xac, 0xcf, 0xaf, 0xf8, 0x99, 0x50, 0x98
	};

	unsigned char expected_enc[] = { 0x0a, 0xd0, 0x95, 0x0d, 0x9f, 0xb9,
					 0x58, 0x8e, 0x59, 0x69, 0x0b, 0x74,
					 0xf1, 0x23, 0x7e, 0xcd, 0xf1, 0xd7,
					 0x75, 0xcd, 0x60, 0xbe, 0x2e, 0xca,
					 0x57, 0xaf, 0x5a, 0x4b, 0x04, 0x71,
					 0xc9, 0x1b };

	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a13(void)
{
	unsigned char a13_seq0_expected_ct[] = {
		0x5f, 0xd9, 0x2c, 0xc9, 0xd4, 0x6d, 0xbf, 0x89, 0x43,
		0xe7, 0x2a, 0x07, 0xe4, 0x2f, 0x36, 0x3e, 0xd5, 0xf7,
		0x21, 0x21, 0x2c, 0xd9, 0x0b, 0xcf, 0xd0, 0x72, 0xbf,
		0xd9, 0xf4, 0x4e, 0x06, 0xb8, 0x0f, 0xd1, 0x78, 0x24,
		0x94, 0x74, 0x96, 0xe2, 0x1b, 0x68, 0x0c, 0x14, 0x1b
	};

	unsigned char a13_seq1_expected_ct[] = {
		0xd3, 0x73, 0x6b, 0xb2, 0x56, 0xc1, 0x9b, 0xfa, 0x93,
		0xd7, 0x9e, 0x8f, 0x80, 0xb7, 0x97, 0x12, 0x62, 0xcb,
		0x7c, 0x88, 0x7e, 0x35, 0xc2, 0x63, 0x70, 0xcf, 0xed,
		0x62, 0x25, 0x43, 0x69, 0xa1, 0xb5, 0x2e, 0x3d, 0x50,
		0x5b, 0x79, 0xdd, 0x69, 0x9f, 0x00, 0x2b, 0xc8, 0xed
	};

	unsigned char a13_seq2_expected_ct[] = {
		0x12, 0x21, 0x75, 0xcf, 0xd5, 0x67, 0x8e, 0x04, 0x89,
		0x4e, 0x4f, 0xf8, 0x78, 0x9e, 0x85, 0xdd, 0x38, 0x1d,
		0xf4, 0x8d, 0xca, 0xf9, 0x70, 0xd5, 0x20, 0x57, 0xdf,
		0x2c, 0x9a, 0xcc, 0x3b, 0x12, 0x13, 0x13, 0xa2, 0xbf,
		0xea, 0xa9, 0x86, 0x05, 0x0f, 0x82, 0xd9, 0x36, 0x45
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { a13_seq0_expected_ct,
					   sizeof(a13_seq0_expected_ct) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { a13_seq1_expected_ct,
					   sizeof(a13_seq1_expected_ct) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { a13_seq2_expected_ct,
					   sizeof(a13_seq2_expected_ct) } }
	};

	unsigned char a13_expected_exporter_value_1[] = {
		0x28, 0xc7, 0x00, 0x88, 0x01, 0x7d, 0x70, 0xc8,
		0x96, 0xa8, 0x42, 0x0f, 0x04, 0x70, 0x2c, 0x5a,
		0x32, 0x1d, 0x9c, 0xbf, 0x02, 0x79, 0xfb, 0xa8,
		0x99, 0xb5, 0x9e, 0x51, 0xba, 0xc7, 0x2c, 0x85
	};

	unsigned char a13_expected_exporter_value_2[] = {
		0x25, 0xdf, 0xc0, 0x04, 0xb0, 0x89, 0x2b, 0xe1,
		0x88, 0x8c, 0x39, 0x14, 0x97, 0x7a, 0xa9, 0xc9,
		0xbb, 0xaf, 0x2c, 0x74, 0x71, 0x70, 0x8a, 0x49,
		0xe1, 0x19, 0x5a, 0xf4, 0x8a, 0x6f, 0x29, 0xce
	};

	unsigned char a13_expected_exporter_value_3[] = {
		0x5a, 0x01, 0x31, 0x81, 0x3a, 0xbc, 0x9a, 0x52,
		0x2c, 0xad, 0x67, 0x8e, 0xb6, 0xba, 0xfa, 0xab,
		0xc4, 0x33, 0x89, 0x93, 0x4a, 0xdb, 0x80, 0x97,
		0xd2, 0x3c, 0x5f, 0xf6, 0x80, 0x59, 0xeb, 0x64
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(a13_expected_exporter_value_1),
		  .expected_exporter_value = { a13_expected_exporter_value_1,
					       sizeof(a13_expected_exporter_value_1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(a13_expected_exporter_value_2),
		  .expected_exporter_value = { a13_expected_exporter_value_2,
					       sizeof(a13_expected_exporter_value_2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(a13_expected_exporter_value_3),
		  .expected_exporter_value = { a13_expected_exporter_value_3,
					       sizeof(a13_expected_exporter_value_3) } }
	};

	unsigned char ikmE[] = {
		0x6e, 0x6d, 0x8f, 0x20, 0x0e, 0xa2, 0xfb, 0x20,
		0xc3, 0x0b, 0x00, 0x3a, 0x8b, 0x4f, 0x43, 0x3d,
		0x2f, 0x4e, 0xd4, 0xc2, 0x65, 0x8d, 0x5b, 0xc8,
		0xce, 0x2f, 0xef, 0x71, 0x80, 0x59, 0xc9, 0xf7
	};

	unsigned char ikmR[] = {
		0xf1, 0xd4, 0xa3, 0x0a, 0x4c, 0xef, 0x8d, 0x6d,
		0x4e, 0x3b, 0x01, 0x6e, 0x6f, 0xd3, 0x79, 0x9e,
		0xa0, 0x57, 0xdb, 0x4f, 0x34, 0x54, 0x72, 0xed,
		0x30, 0x2a, 0x67, 0xce, 0x1c, 0x20, 0xcd, 0xec
	};

	unsigned char ikmS[] = {
		0x94, 0xb0, 0x20, 0xce, 0x91, 0xd7, 0x3f, 0xca,
		0x46, 0x49, 0x00, 0x6c, 0x7e, 0x73, 0x29, 0xa6,
		0x7b, 0x40, 0xc5, 0x5e, 0x9e, 0x93, 0xcc, 0x90,
		0x7d, 0x28, 0x2b, 0xbb, 0xff, 0x38, 0x6f, 0x58
	};

	unsigned char expected_enc[] = { 0x23, 0xfb, 0x95, 0x25, 0x71, 0xa1,
					 0x4a, 0x25, 0xe3, 0xd6, 0x78, 0x14,
					 0x0c, 0xd0, 0xe5, 0xeb, 0x47, 0xa0,
					 0x96, 0x1b, 0xb1, 0x8a, 0xfc, 0xf8,
					 0x58, 0x96, 0xe5, 0x45, 0x3c, 0x31,
					 0x2e, 0x76 };

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a14(void)
{
	unsigned char seq0_expected_ct[] = {
		0xa8, 0x4c, 0x64, 0xdf, 0x1e, 0x11, 0xd8, 0xfd, 0x11,
		0x45, 0x00, 0x39, 0xd4, 0xfe, 0x64, 0xff, 0x0c, 0x8a,
		0x99, 0xfc, 0xa0, 0xbd, 0x72, 0xc2, 0xd4, 0xc3, 0xe0,
		0x40, 0x0b, 0xc1, 0x4a, 0x40, 0xf2, 0x7e, 0x45, 0xe1,
		0x41, 0xa2, 0x40, 0x01, 0x69, 0x77, 0x37, 0x53, 0x3e
	};

	unsigned char seq1_expected_ct[] = {
		0x4d, 0x19, 0x30, 0x3b, 0x84, 0x8f, 0x42, 0x4f, 0xc3,
		0xc3, 0xbe, 0xca, 0x24, 0x9b, 0x2c, 0x6d, 0xe0, 0xa3,
		0x40, 0x83, 0xb8, 0xe9, 0x09, 0xb6, 0xaa, 0x4c, 0x36,
		0x88, 0x50, 0x5c, 0x05, 0xff, 0xe0, 0xc8, 0xf5, 0x7a,
		0x0a, 0x4c, 0x5a, 0xb9, 0xda, 0x12, 0x74, 0x35, 0xd9
	};

	unsigned char seq2_expected_ct[] = {
		0x0c, 0x08, 0x5a, 0x36, 0x5f, 0xbf, 0xa6, 0x34, 0x09,
		0x94, 0x3b, 0x00, 0xa3, 0x12, 0x7a, 0xbc, 0xe6, 0xe4,
		0x59, 0x91, 0xbc, 0x65, 0x3f, 0x18, 0x2a, 0x80, 0x12,
		0x08, 0x68, 0xfc, 0x50, 0x7e, 0x9e, 0x4d, 0x5e, 0x37,
		0xbc, 0xc3, 0x84, 0xfc, 0x8f, 0x14, 0x15, 0x3b, 0x24
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_expected_ct,
					   sizeof(seq0_expected_ct) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_expected_ct,
					   sizeof(seq1_expected_ct) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_expected_ct,
					   sizeof(seq2_expected_ct) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x08, 0xf7, 0xe2, 0x06, 0x44, 0xbb, 0x9b, 0x8a,
		0xf5, 0x4a, 0xd6, 0x6d, 0x20, 0x67, 0x45, 0x7c,
		0x5f, 0x9f, 0xcb, 0x2a, 0x23, 0xd9, 0xf6, 0xcb,
		0x44, 0x45, 0xc0, 0x79, 0x7b, 0x33, 0x00, 0x67
	};

	unsigned char expected_exporter_value2[] = {
		0x52, 0xe5, 0x1f, 0xf7, 0xd4, 0x36, 0x55, 0x7c,
		0xed, 0x52, 0x65, 0xff, 0x8b, 0x94, 0xce, 0x69,
		0xcf, 0x75, 0x83, 0xf4, 0x9c, 0xdb, 0x37, 0x4e,
		0x6a, 0xad, 0x80, 0x1f, 0xc0, 0x63, 0xb0, 0x10
	};

	unsigned char expected_exporter_value3[] = {
		0xa3, 0x0c, 0x20, 0x37, 0x0c, 0x02, 0x6b, 0xbe,
		0xa4, 0xdc, 0xa5, 0x1c, 0xb6, 0x37, 0x61, 0x69,
		0x51, 0x32, 0xd3, 0x42, 0xba, 0xe3, 0x3a, 0x6a,
		0x11, 0x52, 0x7d, 0x3e, 0x76, 0x79, 0x43, 0x6d
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x43, 0x03, 0x61, 0x90, 0x85, 0xa2, 0x0e, 0xbc,
		0xf1, 0x8e, 0xdd, 0x22, 0x78, 0x29, 0x52, 0xb8,
		0xa7, 0x16, 0x1e, 0x1d, 0xba, 0xe6, 0xe4, 0x6e,
		0x14, 0x3a, 0x52, 0xa9, 0x61, 0x27, 0xcf, 0x84
	};

	unsigned char ikmR[] = {
		0x4b, 0x16, 0x22, 0x1f, 0x3b, 0x26, 0x9a, 0x88,
		0xe2, 0x07, 0x27, 0x0b, 0x5e, 0x1d, 0xe2, 0x8c,
		0xb0, 0x1f, 0x84, 0x78, 0x41, 0xb3, 0x44, 0xb8,
		0x31, 0x4d, 0x6a, 0x62, 0x2f, 0xe5, 0xee, 0x90
	};

	unsigned char ikmS[] = {
		0x62, 0xf7, 0x7d, 0xcf, 0x5d, 0xf0, 0xdd, 0x7e,
		0xac, 0x54, 0xea, 0xc9, 0xf6, 0x54, 0xf4, 0x26,
		0xd4, 0x16, 0x1e, 0xc8, 0x50, 0xcc, 0x65, 0xc5,
		0x4f, 0x8b, 0x65, 0xd2, 0xe0, 0xb4, 0xe3, 0x45
	};

	unsigned char expected_enc[] = { 0x82, 0x08, 0x18, 0xd3, 0xc2, 0x39,
					 0x93, 0x49, 0x2c, 0xc5, 0x62, 0x3a,
					 0xb4, 0x37, 0xa4, 0x8a, 0x0a, 0x7c,
					 0xa3, 0xe9, 0x63, 0x9c, 0x14, 0x0f,
					 0xe1, 0xe3, 0x38, 0x11, 0xeb, 0x84,
					 0x4b, 0x7c };

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a21(void)
{
	unsigned char seq0_ciphertext[] = {
		0x1c, 0x52, 0x50, 0xd8, 0x03, 0x4e, 0xc2, 0xb7, 0x84,
		0xba, 0x2c, 0xfd, 0x69, 0xdb, 0xdb, 0x8a, 0xf4, 0x06,
		0xcf, 0xe3, 0xff, 0x93, 0x8e, 0x13, 0x1f, 0x0d, 0xef,
		0x8c, 0x8b, 0x60, 0xb4, 0xdb, 0x21, 0x99, 0x3c, 0x62,
		0xce, 0x81, 0x88, 0x3d, 0x2d, 0xd1, 0xb5, 0x1a, 0x28
	};

	unsigned char seq1_ciphertext[] = {
		0x6b, 0x53, 0xc0, 0x51, 0xe4, 0x19, 0x9c, 0x51, 0x8d,
		0xe7, 0x95, 0x94, 0xe1, 0xc4, 0xab, 0x18, 0xb9, 0x6f,
		0x08, 0x15, 0x49, 0xd4, 0x5c, 0xe0, 0x15, 0xbe, 0x00,
		0x20, 0x90, 0xbb, 0x11, 0x9e, 0x85, 0x28, 0x53, 0x37,
		0xcc, 0x95, 0xba, 0x5f, 0x59, 0x99, 0x2d, 0xc9, 0x8c
	};

	unsigned char seq2_ciphertext[] = {
		0x71, 0x14, 0x6b, 0xd6, 0x79, 0x5c, 0xcc, 0x9c, 0x49,
		0xce, 0x25, 0xdd, 0xa1, 0x12, 0xa4, 0x8f, 0x20, 0x2a,
		0xd2, 0x20, 0x55, 0x95, 0x02, 0xce, 0xf1, 0xf3, 0x42,
		0x71, 0xe0, 0xcb, 0x4b, 0x02, 0xb4, 0xf1, 0x0e, 0xca,
		0xc6, 0xf4, 0x8c, 0x32, 0xf8, 0x78, 0xfa, 0xe8, 0x6b
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x4b, 0xbd, 0x62, 0x43, 0xb8, 0xbb, 0x54, 0xce,
		0xc3, 0x11, 0xfa, 0xc9, 0xdf, 0x81, 0x84, 0x1b,
		0x6f, 0xd6, 0x1f, 0x56, 0x53, 0x8a, 0x77, 0x5e,
		0x7c, 0x80, 0xa9, 0xf4, 0x01, 0x60, 0x60, 0x6e
	};

	unsigned char expected_exporter_value2[] = {
		0x8c, 0x1d, 0xf1, 0x47, 0x32, 0x58, 0x0e, 0x55,
		0x01, 0xb0, 0x0f, 0x82, 0xb1, 0x0a, 0x16, 0x47,
		0xb4, 0x07, 0x13, 0x19, 0x1b, 0x7c, 0x12, 0x40,
		0xac, 0x80, 0xe2, 0xb6, 0x88, 0x08, 0xba, 0x69
	};

	unsigned char expected_exporter_value3[] = {
		0x5a, 0xcb, 0x09, 0x21, 0x11, 0x39, 0xc4, 0x3b,
		0x30, 0x90, 0x48, 0x9a, 0x9d, 0xa4, 0x33, 0xe8,
		0xa3, 0x0e, 0xe7, 0x18, 0x8b, 0xa8, 0xb0, 0xa9,
		0xa1, 0xcc, 0xf0, 0xc2, 0x29, 0x28, 0x3e, 0x53
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x90, 0x9a, 0x9b, 0x35, 0xd3, 0xdc, 0x47, 0x13,
		0xa5, 0xe7, 0x2a, 0x4d, 0xa2, 0x74, 0xb5, 0x5d,
		0x3d, 0x38, 0x21, 0xa3, 0x7e, 0x5d, 0x09, 0x9e,
		0x74, 0xa6, 0x47, 0xdb, 0x58, 0x3a, 0x90, 0x4b
	};

	unsigned char ikmR[] = {
		0x1a, 0xc0, 0x1f, 0x18, 0x1f, 0xdf, 0x9f, 0x35,
		0x27, 0x97, 0x65, 0x51, 0x61, 0xc5, 0x8b, 0x75,
		0xc6, 0x56, 0xa6, 0xcc, 0x27, 0x16, 0xdc, 0xb6,
		0x63, 0x72, 0xda, 0x83, 0x55, 0x42, 0xe1, 0xdf
	};

	unsigned char expected_enc[] = { 0x1a, 0xfa, 0x08, 0xd3, 0xde, 0xc0,
					 0x47, 0xa6, 0x43, 0x88, 0x51, 0x63,
					 0xf1, 0x18, 0x04, 0x76, 0xfa, 0x7d,
					 0xdb, 0x54, 0xc6, 0xa8, 0x02, 0x9e,
					 0xa3, 0x3f, 0x95, 0x79, 0x6b, 0xf2,
					 0xac, 0x4a };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_BASE,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a22(void)
{
	unsigned char seq0_ciphertext[] = {
		0x4a, 0x17, 0x7f, 0x9c, 0x0d, 0x6f, 0x15, 0xcf, 0xdf,
		0x53, 0x3f, 0xb6, 0x5b, 0xf8, 0x4a, 0xec, 0xdc, 0x6a,
		0xb1, 0x6b, 0x8b, 0x85, 0xb4, 0xcf, 0x65, 0xa3, 0x70,
		0xe0, 0x7f, 0xc1, 0xd7, 0x8d, 0x28, 0xfb, 0x07, 0x32,
		0x14, 0x52, 0x52, 0x76, 0xf4, 0xa8, 0x96, 0x08, 0xff
	};

	unsigned char seq1_ciphertext[] = {
		0x5c, 0x3c, 0xab, 0xae, 0x2f, 0x0b, 0x3e, 0x12, 0x4d,
		0x8d, 0x86, 0x4c, 0x11, 0x6f, 0xd8, 0xf2, 0x0f, 0x3f,
		0x56, 0xfd, 0xa9, 0x88, 0xc3, 0x57, 0x3b, 0x40, 0xb0,
		0x99, 0x97, 0xfd, 0x6c, 0x76, 0x9e, 0x77, 0xc8, 0xed,
		0xa6, 0xcd, 0xa4, 0xf9, 0x47, 0xf5, 0xb7, 0x04, 0xa8
	};

	unsigned char seq2_ciphertext[] = {
		0x14, 0x95, 0x89, 0x00, 0xb4, 0x4b, 0xda, 0xe9, 0xcb,
		0xe5, 0xa5, 0x28, 0xbf, 0x93, 0x3c, 0x5c, 0x99, 0x0d,
		0xbb, 0x8e, 0x28, 0x2e, 0x6e, 0x49, 0x5a, 0xdf, 0x82,
		0x05, 0xd1, 0x9d, 0xa9, 0xeb, 0x27, 0x0e, 0x3a, 0x6f,
		0x1e, 0x06, 0x13, 0xab, 0x7e, 0x75, 0x79, 0x62, 0xa4
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x81, 0x3c, 0x1b, 0xfc, 0x51, 0x6c, 0x99, 0x07,
		0x6a, 0xe0, 0xf4, 0x66, 0x67, 0x1f, 0x0b, 0xa5,
		0xff, 0x24, 0x4a, 0x41, 0x69, 0x9f, 0x7b, 0x24,
		0x17, 0xe4, 0xc5, 0x9d, 0x46, 0xd3, 0x9f, 0x40
	};

	unsigned char expected_exporter_value2[] = {
		0x27, 0x45, 0xcf, 0x3d, 0x5b, 0xb6, 0x5c, 0x33,
		0x36, 0x58, 0x73, 0x29, 0x54, 0xee, 0x7a, 0xf4,
		0x9e, 0xb8, 0x95, 0xce, 0x77, 0xf8, 0x02, 0x28,
		0x73, 0xa6, 0x2a, 0x13, 0xc9, 0x4c, 0xb4, 0xe1
	};

	unsigned char expected_exporter_value3[] = {
		0xad, 0x40, 0xe3, 0xae, 0x14, 0xf2, 0x1c, 0x99,
		0xbf, 0xde, 0xbc, 0x20, 0xae, 0x14, 0xab, 0x86,
		0xf4, 0xca, 0x2d, 0xc9, 0xa4, 0x79, 0x9d, 0x20,
		0x0f, 0x43, 0xa2, 0x5f, 0x99, 0xfa, 0x78, 0xae
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x35, 0x70, 0x6a, 0x0b, 0x09, 0xfb, 0x26, 0xfb,
		0x45, 0xc3, 0x9c, 0x2f, 0x50, 0x79, 0xc7, 0x09,
		0xc7, 0xcf, 0x98, 0xe4, 0x3a, 0xfa, 0x97, 0x3f,
		0x14, 0xd8, 0x8e, 0xce, 0x7e, 0x29, 0xc2, 0xe3
	};

	unsigned char ikmR[] = {
		0x26, 0xb9, 0x23, 0xea, 0xde, 0x72, 0x94, 0x1c,
		0x8a, 0x85, 0xb0, 0x99, 0x86, 0xcd, 0xfa, 0x3f,
		0x12, 0x96, 0x85, 0x22, 0x61, 0xad, 0xed, 0xc5,
		0x2d, 0x58, 0xd2, 0x93, 0x02, 0x69, 0x81, 0x2b
	};

	unsigned char expected_enc[] = { 0x22, 0x61, 0x29, 0x9c, 0x3f, 0x40,
					 0xa9, 0xaf, 0xc1, 0x33, 0xb9, 0x69,
					 0xa9, 0x7f, 0x05, 0xe9, 0x5b, 0xe2,
					 0xc5, 0x14, 0xe5, 0x4f, 0x3d, 0xe2,
					 0x6c, 0xbe, 0x56, 0x44, 0xac, 0x73,
					 0x5b, 0x04 };

	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a23(void)
{
	unsigned char seq0_ciphertext[] = {
		0xab, 0x1a, 0x13, 0xc9, 0xd4, 0xf0, 0x1a, 0x87, 0xec,
		0x34, 0x40, 0xdb, 0xd7, 0x56, 0xe2, 0x67, 0x7b, 0xd2,
		0xec, 0xf9, 0xdf, 0x0c, 0xe7, 0xed, 0x73, 0x86, 0x9b,
		0x98, 0xe0, 0x0c, 0x09, 0xbe, 0x11, 0x1c, 0xb9, 0xfd,
		0xf0, 0x77, 0x34, 0x7a, 0xeb, 0x88, 0xe6, 0x1b, 0xdf
	};

	unsigned char seq1_ciphertext[] = {
		0x32, 0x65, 0xc7, 0x80, 0x7f, 0xff, 0xf7, 0xfd, 0xac,
		0xe2, 0x16, 0x59, 0xa2, 0xc6, 0xcc, 0xff, 0xee, 0x52,
		0xa2, 0x6d, 0x27, 0x0c, 0x76, 0x46, 0x8e, 0xd7, 0x42,
		0x02, 0xa6, 0x54, 0x78, 0xbf, 0xae, 0xdf, 0xff, 0x9c,
		0x2b, 0x76, 0x34, 0xe2, 0x4f, 0x10, 0xb7, 0x10, 0x16
	};

	unsigned char seq2_ciphertext[] = {
		0x3a, 0xad, 0xee, 0x86, 0xad, 0x2a, 0x05, 0x08, 0x1e,
		0xa8, 0x60, 0x03, 0x3a, 0x9d, 0x09, 0xdb, 0xcc, 0xb4,
		0xac, 0xac, 0x2d, 0xed, 0x08, 0x91, 0xda, 0x40, 0xf5,
		0x1d, 0x4d, 0xf1, 0x99, 0x25, 0xf7, 0xa7, 0x67, 0xb0,
		0x76, 0xa5, 0xcb, 0xc9, 0x35, 0x5c, 0x8f, 0xd3, 0x5e
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x07, 0x0c, 0xff, 0xaf, 0xd8, 0x9b, 0x67, 0xb7,
		0xf0, 0xee, 0xb8, 0x00, 0x23, 0x53, 0x03, 0xa2,
		0x23, 0xe6, 0xff, 0x9d, 0x1e, 0x77, 0x4d, 0xce,
		0x8e, 0xac, 0x58, 0x5c, 0x86, 0x88, 0xc8, 0x72
	};

	unsigned char expected_exporter_value2[] = {
		0x28, 0x52, 0xe7, 0x28, 0x56, 0x8d, 0x40, 0xdd,
		0xb0, 0xed, 0xde, 0x28, 0x4d, 0x36, 0xa4, 0x35,
		0x9c, 0x56, 0x55, 0x8b, 0xb2, 0xfb, 0x88, 0x37,
		0xcd, 0x3d, 0x92, 0xe4, 0x6a, 0x3a, 0x14, 0xa8
	};

	unsigned char expected_exporter_value3[] = {
		0x1d, 0xf3, 0x9d, 0xc5, 0xdd, 0x60, 0xed, 0xcb,
		0xf5, 0xf9, 0xae, 0x80, 0x4e, 0x15, 0xad, 0xa6,
		0x6e, 0x88, 0x5b, 0x28, 0xed, 0x79, 0x29, 0x11,
		0x6f, 0x76, 0x83, 0x69, 0xa3, 0xf9, 0x50, 0xee
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x93, 0x8d, 0x3d, 0xaa, 0x5a, 0x89, 0x04, 0x54,
		0x0b, 0xc2, 0x4f, 0x48, 0xae, 0x90, 0xee, 0xd3,
		0xf4, 0xf7, 0xf1, 0x18, 0x39, 0x56, 0x05, 0x97,
		0xb5, 0x5e, 0x7c, 0x95, 0x98, 0xc9, 0x96, 0xc0
	};

	unsigned char ikmR[] = {
		0x64, 0x83, 0x5d, 0x5e, 0xe6, 0x4a, 0xa7, 0xaa,
		0xd5, 0x7c, 0x6f, 0x2e, 0x4f, 0x75, 0x8f, 0x76,
		0x96, 0x61, 0x7f, 0x88, 0x29, 0xe7, 0x0b, 0xc9,
		0xac, 0x7a, 0x5e, 0xf9, 0x5d, 0x1c, 0x75, 0x6c
	};

	unsigned char ikmS[] = {
		0x9d, 0x8f, 0x94, 0x53, 0x7d, 0x5a, 0x3d, 0xde,
		0xf7, 0x12, 0x34, 0xc0, 0xba, 0xed, 0xfa, 0xd4,
		0xca, 0x68, 0x61, 0x63, 0x4d, 0x0b, 0x94, 0xc3,
		0x00, 0x7f, 0xed, 0x55, 0x7a, 0xd1, 0x7d, 0xf6
	};

	unsigned char expected_enc[] = { 0xf7, 0x67, 0x4c, 0xc8, 0xcd, 0x7b,
					 0xaa, 0x58, 0x72, 0xd1, 0xf3, 0x3d,
					 0xba, 0xff, 0xe3, 0x31, 0x42, 0x39,
					 0xf6, 0x19, 0x7d, 0xdf, 0x5d, 0xed,
					 0x17, 0x46, 0x76, 0x0b, 0xfc, 0x84,
					 0x7e, 0x0e };

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a24(void)
{
	unsigned char seq0_ciphertext[] = {
		0x9a, 0xa5, 0x2e, 0x29, 0x27, 0x4f, 0xc6, 0x17, 0x2e,
		0x38, 0xa4, 0x46, 0x13, 0x61, 0xd2, 0x34, 0x25, 0x85,
		0xd3, 0xae, 0xec, 0x67, 0xfb, 0x3b, 0x72, 0x1e, 0xcd,
		0x63, 0xf0, 0x59, 0x57, 0x7c, 0x7f, 0xe8, 0x86, 0xbe,
		0x0e, 0xde, 0x01, 0x45, 0x6e, 0xbc, 0x67, 0xd5, 0x97
	};

	unsigned char seq1_ciphertext[] = {
		0x59, 0x46, 0x0b, 0xac, 0xdb, 0xe7, 0xa9, 0x20, 0xef,
		0x28, 0x06, 0xa7, 0x49, 0x37, 0xd5, 0xa6, 0x91, 0xd6,
		0xd5, 0x06, 0x2d, 0x7d, 0xaa, 0xfc, 0xad, 0x7d, 0xb7,
		0xe4, 0xd8, 0xc6, 0x49, 0xad, 0xff, 0xe5, 0x75, 0xc1,
		0x88, 0x9c, 0x5c, 0x2e, 0x3a, 0x49, 0xaf, 0x8e, 0x3e
	};

	unsigned char seq2_ciphertext[] = {
		0x56, 0x88, 0xff, 0x6a, 0x03, 0xba, 0x26, 0xae, 0x93,
		0x60, 0x44, 0xa5, 0xc8, 0x00, 0xf2, 0x86, 0xfb, 0x5d,
		0x1e, 0xcc, 0xdd, 0x2a, 0x0f, 0x26, 0x8f, 0x6f, 0xf9,
		0x77, 0x3b, 0x51, 0x16, 0x93, 0x18, 0xd1, 0xa1, 0x46,
		0x6b, 0xb3, 0x62, 0x63, 0x41, 0x50, 0x71, 0xdb, 0x00
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0xc2, 0x3e, 0xbd, 0x4e, 0x7a, 0x0a, 0xd0, 0x6a,
		0x5d, 0xdd, 0xf7, 0x79, 0xf6, 0x50, 0x04, 0xce,
		0x94, 0x81, 0x06, 0x9c, 0xe0, 0xf0, 0xe6, 0xdd,
		0x51, 0xa0, 0x45, 0x39, 0xdd, 0xcb, 0xd5, 0xcd
	};

	unsigned char expected_exporter_value2[] = {
		0xed, 0x7f, 0xf5, 0xca, 0x40, 0xa3, 0xd8, 0x45,
		0x61, 0x06, 0x7e, 0xbc, 0x8e, 0x01, 0x70, 0x2b,
		0xc3, 0x6c, 0xf1, 0xeb, 0x99, 0xd4, 0x2a, 0x92,
		0x00, 0x46, 0x42, 0xb9, 0xdf, 0xaa, 0xdd, 0x37
	};

	unsigned char expected_exporter_value3[] = {
		0xd3, 0xba, 0xe0, 0x66, 0xaa, 0x8d, 0xa2, 0x7d,
		0x52, 0x7d, 0x85, 0xc0, 0x40, 0xf7, 0xdd, 0x6c,
		0xcb, 0x60, 0x22, 0x1c, 0x90, 0x2e, 0xe3, 0x6a,
		0x82, 0xf7, 0x0b, 0xcd, 0x62, 0xa6, 0x0e, 0xe4
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x49, 0xd6, 0xea, 0xc8, 0xc6, 0xc5, 0x58, 0xc9,
		0x53, 0xa0, 0xa2, 0x52, 0x92, 0x9a, 0x81, 0x87,
		0x45, 0xbb, 0x08, 0xcd, 0x3d, 0x29, 0xe1, 0x5f,
		0x9f, 0x5d, 0xb5, 0xeb, 0x2e, 0x7d, 0x4b, 0x84
	};

	unsigned char ikmR[] = {
		0xf3, 0x30, 0x4d, 0xdc, 0xf1, 0x58, 0x48, 0x48,
		0x82, 0x71, 0xf1, 0x2b, 0x75, 0xec, 0xaf, 0x72,
		0x30, 0x1f, 0xaa, 0xbf, 0x6a, 0xd2, 0x83, 0x65,
		0x4a, 0x14, 0xc3, 0x98, 0x83, 0x2e, 0xb1, 0x84
	};

	unsigned char ikmS[] = {
		0x20, 0xad, 0xe1, 0xd5, 0x20, 0x3d, 0xe1, 0xaa,
		0xdf, 0xb2, 0x61, 0xc4, 0x70, 0x0b, 0x64, 0x32,
		0xe2, 0x60, 0xd0, 0xd3, 0x17, 0xbe, 0x6e, 0xbb,
		0xb8, 0xd7, 0xff, 0xfb, 0x1f, 0x86, 0xad, 0x9d
	};

	unsigned char expected_enc[] = { 0x65, 0x6a, 0x2e, 0x00, 0xdc, 0x99,
					 0x90, 0xfd, 0x18, 0x9e, 0x6e, 0x47,
					 0x34, 0x59, 0x39, 0x2d, 0xf5, 0x56,
					 0xe9, 0xa2, 0x75, 0x87, 0x54, 0xa0,
					 0x9d, 0xb3, 0xf5, 0x11, 0x79, 0xa3,
					 0xfc, 0x02 };

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a31(void)
{
	unsigned char seq0_ciphertext[] = {
		0x5a, 0xd5, 0x90, 0xbb, 0x8b, 0xaa, 0x57, 0x7f, 0x86,
		0x19, 0xdb, 0x35, 0xa3, 0x63, 0x11, 0x22, 0x6a, 0x89,
		0x6e, 0x73, 0x42, 0xa6, 0xd8, 0x36, 0xd8, 0xb7, 0xbc,
		0xd2, 0xf2, 0x0b, 0x6c, 0x7f, 0x90, 0x76, 0xac, 0x23,
		0x2e, 0x3a, 0xb2, 0x52, 0x3f, 0x39, 0x51, 0x34, 0x34
	};

	unsigned char seq1_ciphertext[] = {
		0xfa, 0x6f, 0x03, 0x7b, 0x47, 0xfc, 0x21, 0x82, 0x6b,
		0x61, 0x01, 0x72, 0xca, 0x96, 0x37, 0xe8, 0x2d, 0x6e,
		0x58, 0x01, 0xeb, 0x31, 0xcb, 0xd3, 0x74, 0x82, 0x71,
		0xaf, 0xfd, 0x4e, 0xcb, 0x06, 0x64, 0x6e, 0x03, 0x29,
		0xcb, 0xdf, 0x3c, 0x3c, 0xd6, 0x55, 0xb2, 0x8e, 0x82
	};

	unsigned char seq2_ciphertext[] = {
		0x89, 0x5c, 0xab, 0xfa, 0xc5, 0x0c, 0xe6, 0xc6, 0xeb,
		0x02, 0xff, 0xe6, 0xc0, 0x48, 0xbf, 0x53, 0xb7, 0xf7,
		0xbe, 0x9a, 0x91, 0xfc, 0x55, 0x94, 0x02, 0xcb, 0xc5,
		0xb8, 0xdc, 0xae, 0xb5, 0x2b, 0x2c, 0xcc, 0x93, 0xe4,
		0x66, 0xc2, 0x8f, 0xb5, 0x5f, 0xed, 0x7a, 0x7f, 0xec
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x5e, 0x9b, 0xc3, 0xd2, 0x36, 0xe1, 0x91, 0x1d,
		0x95, 0xe6, 0x5b, 0x57, 0x6a, 0x8a, 0x86, 0xd4,
		0x78, 0xfb, 0x82, 0x7e, 0x8b, 0xdf, 0xe7, 0x7b,
		0x74, 0x1b, 0x28, 0x98, 0x90, 0x49, 0x0d, 0x4d
	};

	unsigned char expected_exporter_value2[] = {
		0x6c, 0xff, 0x87, 0x65, 0x89, 0x31, 0xbd, 0xa8,
		0x3d, 0xc8, 0x57, 0xe6, 0x35, 0x3e, 0xfe, 0x49,
		0x87, 0xa2, 0x01, 0xb8, 0x49, 0x65, 0x8d, 0x9b,
		0x04, 0x7a, 0xab, 0x4c, 0xf2, 0x16, 0xe7, 0x96
	};

	unsigned char expected_exporter_value3[] = {
		0xd8, 0xf1, 0xea, 0x79, 0x42, 0xad, 0xbb, 0xa7,
		0x41, 0x2c, 0x6d, 0x43, 0x1c, 0x62, 0xd0, 0x13,
		0x71, 0xea, 0x47, 0x6b, 0x82, 0x3e, 0xb6, 0x97,
		0xe1, 0xf6, 0xe6, 0xca, 0xe1, 0xda, 0xb8, 0x5a
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x42, 0x70, 0xe5, 0x4f, 0xfd, 0x08, 0xd7, 0x9d,
		0x59, 0x28, 0x02, 0x0a, 0xf4, 0x68, 0x6d, 0x8f,
		0x6b, 0x7d, 0x35, 0xdb, 0xe4, 0x70, 0x26, 0x5f,
		0x1f, 0x5a, 0xa2, 0x28, 0x16, 0xce, 0x86, 0x0e
	};

	unsigned char ikmR[] = {
		0x66, 0x8b, 0x37, 0x17, 0x1f, 0x10, 0x72, 0xf3,
		0xcf, 0x12, 0xea, 0x8a, 0x23, 0x6a, 0x45, 0xdf,
		0x23, 0xfc, 0x13, 0xb8, 0x2a, 0xf3, 0x60, 0x9a,
		0xd1, 0xe3, 0x54, 0xf6, 0xef, 0x81, 0x75, 0x50
	};

	unsigned char expected_enc[] = {
		0x04, 0xa9, 0x27, 0x19, 0xc6, 0x19, 0x5d, 0x50, 0x85, 0x10,
		0x4f, 0x46, 0x9a, 0x8b, 0x98, 0x14, 0xd5, 0x83, 0x8f, 0xf7,
		0x2b, 0x60, 0x50, 0x1e, 0x2c, 0x44, 0x66, 0xe5, 0xe6, 0x7b,
		0x32, 0x5a, 0xc9, 0x85, 0x36, 0xd7, 0xb6, 0x1a, 0x1a, 0xf4,
		0xb7, 0x8e, 0x5b, 0x7f, 0x95, 0x1c, 0x09, 0x00, 0xbe, 0x86,
		0x3c, 0x40, 0x3c, 0xe6, 0x5c, 0x9b, 0xfc, 0xb9, 0x38, 0x26,
		0x57, 0x22, 0x2d, 0x18, 0xc4
	};

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_BASE,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a32(void)
{
	unsigned char seq0_ciphertext[] = {
		0x90, 0xc4, 0xde, 0xb5, 0xb7, 0x53, 0x18, 0x53, 0x01,
		0x94, 0xe4, 0xbb, 0x62, 0xf8, 0x90, 0xb0, 0x19, 0xb1,
		0x39, 0x7b, 0xbf, 0x9d, 0x0d, 0x6e, 0xb9, 0x18, 0x89,
		0x0e, 0x1f, 0xb2, 0xbe, 0x1a, 0xc2, 0x60, 0x31, 0x93,
		0xb6, 0x0a, 0x49, 0xc2, 0x12, 0x6b, 0x75, 0xd0, 0xeb
	};

	unsigned char seq1_ciphertext[] = {
		0x9e, 0x22, 0x33, 0x84, 0xa3, 0x62, 0x0f, 0x4a, 0x75,
		0xb5, 0xa5, 0x2f, 0x54, 0x6b, 0x72, 0x62, 0xd8, 0x82,
		0x6d, 0xea, 0x18, 0xdb, 0x5a, 0x36, 0x5f, 0xeb, 0x8b,
		0x99, 0x71, 0x80, 0xb2, 0x2d, 0x72, 0xdc, 0x12, 0x87,
		0xf7, 0x08, 0x9a, 0x10, 0x73, 0xa7, 0x10, 0x2c, 0x27
	};

	unsigned char seq2_ciphertext[] = {
		0xad, 0xf9, 0xf6, 0x00, 0x07, 0x73, 0x03, 0x50, 0x23,
		0xbe, 0x7d, 0x41, 0x5e, 0x13, 0xf8, 0x4c, 0x1c, 0xb3,
		0x2a, 0x24, 0x33, 0x9a, 0x32, 0xeb, 0x81, 0xdf, 0x02,
		0xbe, 0x9d, 0xdc, 0x6a, 0xbc, 0x88, 0x0d, 0xd8, 0x1c,
		0xce, 0xb7, 0xc1, 0xd0, 0xc7, 0x78, 0x14, 0x65, 0xb2
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0xa1, 0x15, 0xa5, 0x9b, 0xf4, 0xdd, 0x8d, 0xc4,
		0x93, 0x32, 0xd6, 0xa0, 0x09, 0x3a, 0xf8, 0xef,
		0xca, 0x1b, 0xcb, 0xfd, 0x36, 0x27, 0xd8, 0x50,
		0x17, 0x3f, 0x5c, 0x4a, 0x55, 0xd0, 0xc1, 0x85
	};

	unsigned char expected_exporter_value2[] = {
		0x45, 0x17, 0xea, 0xed, 0xe0, 0x66, 0x9b, 0x16,
		0xaa, 0xc7, 0xc9, 0x2d, 0x57, 0x62, 0xdd, 0x45,
		0x9c, 0x30, 0x1f, 0xa1, 0x0e, 0x02, 0x23, 0x7c,
		0xd5, 0xae, 0xb9, 0xbe, 0x96, 0x94, 0x30, 0xc4
	};

	unsigned char expected_exporter_value3[] = {
		0x16, 0x4e, 0x02, 0x14, 0x4d, 0x44, 0xb6, 0x07,
		0xa7, 0x72, 0x2e, 0x58, 0xb0, 0xf4, 0x15, 0x6e,
		0x67, 0xc0, 0xc2, 0x87, 0x4d, 0x74, 0xcf, 0x71,
		0xda, 0x6c, 0xa4, 0x8a, 0x4c, 0xbd, 0xc5, 0xe0
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x2a, 0xfa, 0x61, 0x1d, 0x8b, 0x1a, 0x7b, 0x32,
		0x1c, 0x76, 0x1b, 0x48, 0x3b, 0x6a, 0x05, 0x35,
		0x79, 0xaf, 0xa4, 0xf7, 0x67, 0x45, 0x0d, 0x3a,
		0xd0, 0xf8, 0x4a, 0x39, 0xfd, 0xa5, 0x87, 0xa6
	};

	unsigned char ikmR[] = {
		0xd4, 0x2e, 0xf8, 0x74, 0xc1, 0x91, 0x3d, 0x95,
		0x68, 0xc9, 0x40, 0x54, 0x07, 0xc8, 0x05, 0xba,
		0xdd, 0xaf, 0xfd, 0x08, 0x98, 0xa0, 0x0f, 0x1e,
		0x84, 0xe1, 0x54, 0xfa, 0x78, 0x7b, 0x24, 0x29
	};

	unsigned char expected_enc[] = {
		0x04, 0x30, 0x5d, 0x35, 0x56, 0x35, 0x27, 0xbc, 0xe0, 0x37,
		0x77, 0x3d, 0x79, 0xa1, 0x3d, 0xea, 0xbe, 0xd0, 0xe8, 0xe7,
		0xcd, 0xe6, 0x1e, 0xec, 0xee, 0x40, 0x34, 0x96, 0x95, 0x9e,
		0x89, 0xe4, 0xd0, 0xca, 0x70, 0x17, 0x26, 0x69, 0x6d, 0x14,
		0x85, 0x13, 0x7c, 0xcb, 0x53, 0x41, 0xb3, 0xc1, 0xc7, 0xaa,
		0xee, 0x90, 0xa4, 0xa0, 0x24, 0x49, 0x72, 0x5e, 0x74, 0x4b,
		0x11, 0x93, 0xb5, 0x3b, 0x5f
	};

	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a33(void)
{
	unsigned char seq0_ciphertext[] = {
		0x82, 0xff, 0xc8, 0xc4, 0x47, 0x60, 0xdb, 0x69, 0x1a,
		0x07, 0xc5, 0x62, 0x7e, 0x5f, 0xc2, 0xc0, 0x8e, 0x7a,
		0x86, 0x97, 0x9e, 0xe7, 0x9b, 0x49, 0x4a, 0x17, 0xcc,
		0x34, 0x05, 0x44, 0x6a, 0xc2, 0xbd, 0xb8, 0xf2, 0x65,
		0xdb, 0x4a, 0x09, 0x9e, 0xd3, 0x28, 0x9f, 0xfe, 0x19
	};

	unsigned char seq1_ciphertext[] = {
		0xb0, 0xa7, 0x05, 0xa5, 0x45, 0x32, 0xc7, 0xb4, 0xf5,
		0x90, 0x7d, 0xe5, 0x1c, 0x13, 0xdf, 0xfe, 0x1e, 0x08,
		0xd5, 0x5e, 0xe9, 0xba, 0x59, 0x68, 0x61, 0x14, 0xb0,
		0x59, 0x45, 0x49, 0x4d, 0x96, 0x72, 0x5b, 0x23, 0x94,
		0x68, 0xf1, 0x22, 0x9e, 0x39, 0x66, 0xaa, 0x12, 0x50
	};

	unsigned char seq2_ciphertext[] = {
		0x8d, 0xc8, 0x05, 0x68, 0x0e, 0x32, 0x71, 0xa8, 0x01,
		0x79, 0x08, 0x33, 0xed, 0x74, 0x47, 0x37, 0x10, 0x15,
		0x76, 0x45, 0x58, 0x4f, 0x06, 0xd1, 0xb5, 0x3a, 0xd4,
		0x39, 0x07, 0x8d, 0x88, 0x0b, 0x23, 0xe2, 0x52, 0x56,
		0x66, 0x31, 0x78, 0x27, 0x1c, 0x80, 0xee, 0x8b, 0x7c
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x83, 0x7e, 0x49, 0xc3, 0xff, 0x62, 0x92, 0x50,
		0xc8, 0xd8, 0x0d, 0x3c, 0x3f, 0xb9, 0x57, 0x72,
		0x5e, 0xd4, 0x81, 0xe5, 0x9e, 0x2f, 0xeb, 0x57,
		0xaf, 0xd9, 0xfe, 0x9a, 0x8c, 0x7c, 0x44, 0x97
	};

	unsigned char expected_exporter_value2[] = {
		0x59, 0x42, 0x13, 0xf9, 0x01, 0x8d, 0x61, 0x4b,
		0x82, 0x00, 0x7a, 0x70, 0x21, 0xc3, 0x13, 0x5b,
		0xda, 0x7b, 0x38, 0x0d, 0xa4, 0xac, 0xd9, 0xab,
		0x27, 0x16, 0x5c, 0x50, 0x86, 0x40, 0xdb, 0xda
	};

	unsigned char expected_exporter_value3[] = {
		0x14, 0xfe, 0x63, 0x4f, 0x95, 0xca, 0x0d, 0x86,
		0xe1, 0x52, 0x47, 0xcc, 0xa7, 0xde, 0x7b, 0xa9,
		0xb7, 0x3c, 0x9b, 0x9d, 0xeb, 0x64, 0x37, 0xe1,
		0xc8, 0x32, 0xda, 0xf7, 0x29, 0x1b, 0x79, 0xd5
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x79, 0x8d, 0x82, 0xa8, 0xd9, 0xea, 0x19, 0xdb,
		0xc7, 0xf2, 0xc6, 0xdf, 0xa5, 0x4e, 0x8a, 0x67,
		0x06, 0xf7, 0xcd, 0xc1, 0x19, 0xdb, 0x08, 0x13,
		0xda, 0xcf, 0x84, 0x40, 0xab, 0x37, 0xc8, 0x57
	};

	unsigned char ikmR[] = {
		0x7b, 0xc9, 0x3b, 0xde, 0x88, 0x90, 0xd1, 0xfb,
		0x55, 0x22, 0x0e, 0x7f, 0x3b, 0x0c, 0x10, 0x7a,
		0xe7, 0xe6, 0xed, 0xa3, 0x5c, 0xa4, 0x04, 0x0b,
		0xb6, 0x65, 0x12, 0x84, 0xbf, 0x07, 0x47, 0xee
	};

	unsigned char ikmS[] = {
		0x87, 0x4b, 0xaa, 0x0d, 0xcf, 0x93, 0x59, 0x5a,
		0x24, 0xa4, 0x5a, 0x7f, 0x04, 0x2e, 0x0d, 0x22,
		0xd3, 0x68, 0x74, 0x7d, 0xaa, 0xa7, 0xe1, 0x9f,
		0x80, 0xa8, 0x02, 0xaf, 0x19, 0x20, 0x4b, 0xa8
	};

	unsigned char expected_enc[] = {
		0x04, 0x22, 0x24, 0xf3, 0xea, 0x80, 0x0f, 0x7e, 0xc5, 0x5c,
		0x03, 0xf2, 0x9f, 0xc9, 0x86, 0x5f, 0x6e, 0xe2, 0x70, 0x04,
		0xf8, 0x18, 0xfc, 0xbd, 0xc6, 0xdc, 0x68, 0x93, 0x2c, 0x1e,
		0x52, 0xe1, 0x5b, 0x79, 0xe2, 0x64, 0xa9, 0x8f, 0x2c, 0x53,
		0x5e, 0xf0, 0x67, 0x45, 0xf3, 0xd3, 0x08, 0x62, 0x44, 0x14,
		0x15, 0x3b, 0x22, 0xc7, 0x33, 0x2b, 0xc1, 0xe6, 0x91, 0xcb,
		0x4a, 0xf4, 0xd5, 0x34, 0x54
	};

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a34(void)
{
	unsigned char seq0_ciphertext[] = {
		0xb9, 0xf3, 0x6d, 0x58, 0xd9, 0xeb, 0x10, 0x16, 0x29,
		0xa3, 0xe5, 0xa7, 0xb6, 0x3d, 0x2e, 0xe4, 0xaf, 0x42,
		0xb3, 0x64, 0x42, 0x09, 0xab, 0x37, 0xe0, 0xa2, 0x72,
		0xd4, 0x43, 0x65, 0x40, 0x7d, 0xb8, 0xe6, 0x55, 0xc7,
		0x2e, 0x4f, 0xa4, 0x6f, 0x4f, 0xf8, 0x1b, 0x92, 0x46
	};

	unsigned char seq1_ciphertext[] = {
		0x51, 0x78, 0x8c, 0x4e, 0x5d, 0x56, 0x27, 0x67, 0x71,
		0x03, 0x27, 0x49, 0xd0, 0x15, 0xd3, 0xee, 0xa6, 0x51,
		0xaf, 0x0c, 0x7b, 0xb8, 0xe3, 0xda, 0x66, 0x9e, 0xff,
		0xff, 0xed, 0x29, 0x9e, 0xa1, 0xf6, 0x41, 0xdf, 0x62,
		0x1a, 0xf6, 0x55, 0x79, 0xc1, 0x0f, 0xc0, 0x97, 0x36
	};

	unsigned char seq2_ciphertext[] = {
		0x3b, 0x5a, 0x2b, 0xe0, 0x02, 0xe7, 0xb2, 0x99, 0x27,
		0xf0, 0x64, 0x42, 0x94, 0x7e, 0x1c, 0xf7, 0x09, 0xb9,
		0xf8, 0x50, 0x8b, 0x03, 0x82, 0x31, 0x27, 0x38, 0x72,
		0x23, 0xd7, 0x12, 0x70, 0x34, 0x71, 0xc2, 0x66, 0xef,
		0xc3, 0x55, 0xf1, 0xbc, 0x20, 0x36, 0xf3, 0x02, 0x7c
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x59, 0x5c, 0xe0, 0xef, 0xf4, 0x05, 0xd4, 0xb3,
		0xbb, 0x1d, 0x08, 0x30, 0x8d, 0x70, 0xa4, 0xe7,
		0x72, 0x26, 0xce, 0x11, 0x76, 0x6e, 0x0a, 0x94,
		0xc4, 0xfd, 0xb5, 0xd9, 0x00, 0x25, 0xc9, 0x78
	};

	unsigned char expected_exporter_value2[] = {
		0x11, 0x04, 0x72, 0xee, 0x0a, 0xe3, 0x28, 0xf5,
		0x7e, 0xf7, 0x33, 0x2a, 0x98, 0x86, 0xa1, 0x99,
		0x2d, 0x2c, 0x45, 0xb9, 0xb8, 0xd5, 0xab, 0xc9,
		0x42, 0x4f, 0xf6, 0x86, 0x30, 0xf7, 0xd3, 0x8d
	};

	unsigned char expected_exporter_value3[] = {
		0x18, 0xee, 0x4d, 0x00, 0x1a, 0x9d, 0x83, 0xa4,
		0xc6, 0x7e, 0x76, 0xf8, 0x8d, 0xd7, 0x47, 0x76,
		0x65, 0x76, 0xca, 0xc4, 0x38, 0x72, 0x3b, 0xad,
		0x07, 0x00, 0xa9, 0x10, 0xa4, 0xd7, 0x17, 0xe6
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x3c, 0x1f, 0xce, 0xb4, 0x77, 0xec, 0x95, 0x4c,
		0x8d, 0x58, 0xef, 0x32, 0x49, 0xe4, 0xbb, 0x4c,
		0x38, 0x24, 0x1b, 0x59, 0x25, 0xb9, 0x5f, 0x74,
		0x86, 0xe4, 0xd9, 0xf1, 0xd0, 0xd3, 0x5f, 0xbb
	};

	unsigned char ikmR[] = {
		0xab, 0xcc, 0x2d, 0xa5, 0xb3, 0xfa, 0x81, 0xd8,
		0xaa, 0xbd, 0x91, 0xf7, 0xf8, 0x00, 0xa8, 0xcc,
		0xf6, 0x0e, 0xc3, 0x7b, 0x1b, 0x58, 0x5a, 0x5d,
		0x1d, 0x1a, 0xc7, 0x7f, 0x25, 0x8b, 0x6c, 0xca
	};

	unsigned char ikmS[] = {
		0x62, 0x62, 0x03, 0x1f, 0x04, 0x0a, 0x9d, 0xb8,
		0x53, 0xed, 0xd6, 0xf9, 0x1d, 0x22, 0x72, 0x59,
		0x6e, 0xab, 0xbc, 0x78, 0xa2, 0xed, 0x2b, 0xd6,
		0x43, 0xf7, 0x70, 0xec, 0xd0, 0xf1, 0x9b, 0x82
	};

	unsigned char expected_enc[] = {
		0x04, 0x6a, 0x1d, 0xe3, 0xfc, 0x26, 0xa3, 0xd4, 0x3f, 0x4e,
		0x4b, 0xa9, 0x7d, 0xbe, 0x24, 0xf7, 0xe9, 0x91, 0x81, 0x13,
		0x61, 0x29, 0xc4, 0x8f, 0xbe, 0x87, 0x2d, 0x47, 0x43, 0xe2,
		0xb1, 0x31, 0x35, 0x7e, 0xd4, 0xf2, 0x9a, 0x7b, 0x31, 0x7d,
		0xc2, 0x25, 0x09, 0xc7, 0xb0, 0x09, 0x91, 0xae, 0x99, 0x0b,
		0xf6, 0x5f, 0x8b, 0x23, 0x67, 0x00, 0xc8, 0x2a, 0xb7, 0xc1,
		0x1a, 0x84, 0x51, 0x14, 0x01
	};

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_AES_128_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a51(void)
{
	unsigned char seq0_ciphertext[] = {
		0x64, 0x69, 0xc4, 0x1c, 0x5c, 0x81, 0xd3, 0xaa, 0x85,
		0x43, 0x25, 0x31, 0xec, 0xf6, 0x46, 0x0e, 0xc9, 0x45,
		0xbd, 0xe1, 0xeb, 0x42, 0x8c, 0xb2, 0xfe, 0xdf, 0x7a,
		0x29, 0xf5, 0xa6, 0x85, 0xb4, 0xcc, 0xb0, 0xd0, 0x57,
		0xf0, 0x3e, 0xa2, 0x95, 0x2a, 0x27, 0xbb, 0x45, 0x8b
	};

	unsigned char seq1_ciphertext[] = {
		0xf1, 0x56, 0x41, 0x99, 0xf7, 0xe0, 0xe1, 0x10, 0xec,
		0x9c, 0x1b, 0xcd, 0xde, 0x33, 0x21, 0x77, 0xfc, 0x35,
		0xc1, 0xad, 0xf6, 0xe5, 0x7f, 0x8d, 0x1d, 0xf2, 0x40,
		0x22, 0x22, 0x7f, 0xfa, 0x87, 0x16, 0x86, 0x2d, 0xbd,
		0xa2, 0xb1, 0xdc, 0x54, 0x6c, 0x9d, 0x11, 0x43, 0x74
	};

	unsigned char seq2_ciphertext[] = {
		0x39, 0xde, 0x89, 0x72, 0x8b, 0xcb, 0x77, 0x42, 0x69,
		0xf8, 0x82, 0xaf, 0x8d, 0xc5, 0x36, 0x9e, 0x4f, 0x3d,
		0x63, 0x22, 0xd9, 0x86, 0xe8, 0x72, 0xb3, 0xa8, 0xd0,
		0x74, 0xc7, 0xc1, 0x8e, 0x85, 0x49, 0xff, 0x3f, 0x85,
		0xb6, 0xd6, 0x59, 0x2f, 0xf8, 0x7c, 0x3f, 0x31, 0x0c
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x9b, 0x13, 0xc5, 0x10, 0x41, 0x6a, 0xc9, 0x77,
		0xb5, 0x53, 0xbf, 0x17, 0x41, 0x01, 0x88, 0x09,
		0xc2, 0x46, 0xa6, 0x95, 0xf4, 0x5e, 0xff, 0x6d,
		0x3b, 0x03, 0x56, 0xdb, 0xef, 0xe1, 0xe6, 0x60
	};

	unsigned char expected_exporter_value2[] = {
		0x6c, 0x8b, 0x7b, 0xe3, 0xa2, 0x0a, 0x56, 0x84,
		0xed, 0xec, 0xb4, 0x25, 0x36, 0x19, 0xd9, 0x05,
		0x1c, 0xe8, 0x58, 0x3b, 0xaf, 0x85, 0x0e, 0x0c,
		0xb5, 0x3c, 0x40, 0x2b, 0xdc, 0xaf, 0x8e, 0xbb
	};

	unsigned char expected_exporter_value3[] = {
		0x47, 0x7a, 0x50, 0xd8, 0x04, 0xc7, 0xc5, 0x19,
		0x41, 0xf6, 0x9b, 0x8e, 0x32, 0xfe, 0x82, 0x88,
		0x38, 0x6e, 0xe1, 0xa8, 0x49, 0x05, 0xfe, 0x49,
		0x38, 0xd5, 0x89, 0x72, 0xf2, 0x4a, 0xc9, 0x38
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0xf1, 0xf1, 0xa3, 0xbc, 0x95, 0x41, 0x68, 0x71,
		0x53, 0x9e, 0xcb, 0x51, 0xc3, 0xa8, 0xf0, 0xcf,
		0x60, 0x8a, 0xfb, 0x40, 0xfb, 0xbe, 0x30, 0x5c,
		0x0a, 0x72, 0x81, 0x9d, 0x35, 0xc3, 0x3f, 0x1f
	};

	unsigned char ikmR[] = {
		0x61, 0x09, 0x2f, 0x3f, 0x56, 0x99, 0x4d, 0xd4,
		0x24, 0x40, 0x58, 0x99, 0x15, 0x4a, 0x99, 0x18,
		0x35, 0x3e, 0x3e, 0x00, 0x81, 0x71, 0x51, 0x7a,
		0xd5, 0x76, 0xb9, 0x00, 0xdd, 0xb2, 0x75, 0xe7
	};

	unsigned char expected_enc[] = {
		0x04, 0xc0, 0x78, 0x36, 0xa0, 0x20, 0x6e, 0x04, 0xe3, 0x1d,
		0x8a, 0xe9, 0x9b, 0xfd, 0x54, 0x93, 0x80, 0xb0, 0x72, 0xa1,
		0xb1, 0xb8, 0x2e, 0x56, 0x3c, 0x93, 0x5c, 0x09, 0x58, 0x27,
		0x82, 0x4f, 0xc1, 0x55, 0x9e, 0xac, 0x6f, 0xb9, 0xe3, 0xc7,
		0x0c, 0xd3, 0x19, 0x39, 0x68, 0x99, 0x4e, 0x7f, 0xe9, 0x78,
		0x1a, 0xa1, 0x03, 0xf5, 0xb5, 0x0e, 0x93, 0x4b, 0x5b, 0x2f,
		0x38, 0x7e, 0x38, 0x12, 0x91
	};

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_BASE,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a52(void)
{
	unsigned char seq0_ciphertext[] = {
		0x21, 0x43, 0x3e, 0xaf, 0xf2, 0x4d, 0x77, 0x06, 0xf3,
		0xed, 0x5b, 0x9b, 0x2e, 0x70, 0x9b, 0x07, 0x23, 0x0e,
		0x2b, 0x11, 0xdf, 0x1f, 0x2b, 0x1f, 0xe0, 0x7b, 0x3c,
		0x70, 0xd5, 0x94, 0x8a, 0x53, 0xd6, 0xfa, 0x5c, 0x8b,
		0xed, 0x19, 0x40, 0x20, 0xbd, 0x9d, 0xf0, 0x87, 0x7b
	};

	unsigned char seq1_ciphertext[] = {
		0xc7, 0x4a, 0x76, 0x4b, 0x48, 0x92, 0x07, 0x2e, 0xa8,
		0xc2, 0xc5, 0x6b, 0x9b, 0xcd, 0x46, 0xc7, 0xf1, 0xe9,
		0xca, 0x8c, 0xb0, 0xa2, 0x63, 0xf8, 0xb4, 0x0c, 0x2b,
		0xa5, 0x9a, 0xc9, 0xc8, 0x57, 0x03, 0x3f, 0x17, 0x60,
		0x19, 0x56, 0x22, 0x18, 0x76, 0x9d, 0x3e, 0x04, 0x52
	};

	unsigned char seq2_ciphertext[] = {
		0xdc, 0x8c, 0xd6, 0x88, 0x63, 0x47, 0x4d, 0x6e, 0x9c,
		0xbb, 0x6a, 0x65, 0x93, 0x35, 0xa8, 0x6a, 0x54, 0xe0,
		0x36, 0x24, 0x9d, 0x41, 0xac, 0xf9, 0x09, 0xe7, 0x38,
		0xc8, 0x47, 0xff, 0x2b, 0xd3, 0x6f, 0xe3, 0xfc, 0xac,
		0xda, 0x4e, 0xde, 0xda, 0x70, 0x32, 0xc0, 0xa2, 0x20
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x53, 0x0b, 0xbc, 0x2f, 0x68, 0xf0, 0x78, 0xdc,
		0xcc, 0x89, 0xcc, 0x37, 0x1b, 0x4f, 0x4a, 0xde,
		0x37, 0x2c, 0x94, 0x72, 0xba, 0xfe, 0x46, 0x01,
		0xa8, 0x43, 0x2c, 0xbb, 0x93, 0x4f, 0x52, 0x8d
	};

	unsigned char expected_exporter_value2[] = {
		0x6e, 0x25, 0x07, 0x5d, 0xdc, 0xc5, 0x28, 0xc9,
		0x0e, 0xf9, 0x21, 0x8f, 0x80, 0x0c, 0xa3, 0xdf,
		0xe1, 0xb8, 0xff, 0x40, 0x42, 0xde, 0x50, 0x33,
		0x13, 0x3a, 0xdb, 0x8b, 0xd5, 0x4c, 0x40, 0x1d
	};

	unsigned char expected_exporter_value3[] = {
		0x6f, 0x6f, 0xbd, 0x0d, 0x1c, 0x77, 0x33, 0xf7,
		0x96, 0x46, 0x1b, 0x32, 0x35, 0xa8, 0x56, 0xcc,
		0x34, 0xf6, 0x76, 0xfe, 0x61, 0xed, 0x50, 0x9d,
		0xfc, 0x18, 0xfa, 0x16, 0xef, 0xe6, 0xbe, 0x78
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0xe1, 0xa4, 0xe1, 0xd5, 0x0c, 0x4b, 0xfc, 0xf8,
		0x90, 0xf2, 0xb4, 0xc7, 0xd6, 0xb2, 0xd2, 0xac,
		0xa6, 0x13, 0x68, 0xed, 0xdc, 0x3c, 0x84, 0x16,
		0x2d, 0xf2, 0x85, 0x68, 0x43, 0xe1, 0x05, 0x7a
	};

	unsigned char ikmR[] = {
		0xee, 0x51, 0xde, 0xc3, 0x04, 0xab, 0xf9, 0x93,
		0xef, 0x8f, 0xd5, 0x2a, 0xac, 0xdd, 0x3b, 0x53,
		0x91, 0x08, 0xbb, 0xf6, 0xe4, 0x91, 0x94, 0x32,
		0x66, 0xc1, 0xde, 0x89, 0xec, 0x59, 0x6a, 0x17
	};

	unsigned char expected_enc[] = {
		0x04, 0xf3, 0x36, 0x57, 0x8b, 0x72, 0xad, 0x79, 0x32, 0xfe,
		0x86, 0x7c, 0xc4, 0xd2, 0xd4, 0x4a, 0x71, 0x8a, 0x31, 0x80,
		0x37, 0xa0, 0xec, 0x27, 0x11, 0x63, 0x69, 0x9c, 0xee, 0x65,
		0x3f, 0xa8, 0x05, 0xc1, 0xfe, 0xc9, 0x55, 0xe5, 0x62, 0x66,
		0x3e, 0x0c, 0x20, 0x61, 0xbb, 0x96, 0xa8, 0x7d, 0x78, 0x89,
		0x2b, 0xff, 0x0c, 0xc0, 0xba, 0xd7, 0x90, 0x6c, 0x2d, 0x99,
		0x8e, 0xbe, 0x1a, 0x72, 0x46
	};

	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a53(void)
{
	unsigned char seq0_ciphertext[] = {
		0x25, 0x88, 0x1f, 0x21, 0x99, 0x35, 0xee, 0xc5, 0xba,
		0x70, 0xd7, 0xb4, 0x21, 0xf1, 0x3c, 0x35, 0x00, 0x57,
		0x34, 0xf3, 0xe4, 0xd9, 0x59, 0x68, 0x02, 0x70, 0xf5,
		0x5d, 0x71, 0xe2, 0xf5, 0xcb, 0x3b, 0xd2, 0xda, 0xce,
		0xd2, 0x77, 0x0b, 0xf3, 0xd9, 0xd4, 0x91, 0x68, 0x72
	};

	unsigned char seq1_ciphertext[] = {
		0x65, 0x3f, 0x00, 0x36, 0xe5, 0x2a, 0x37, 0x6f, 0x5d,
		0x2d, 0xd8, 0x5b, 0x32, 0x04, 0xb5, 0x54, 0x55, 0xb7,
		0x83, 0x5c, 0x23, 0x12, 0x55, 0xae, 0x09, 0x8d, 0x09,
		0xed, 0x13, 0x87, 0x19, 0xb9, 0x71, 0x85, 0x12, 0x97,
		0x86, 0x33, 0x8a, 0xb6, 0x54, 0x3f, 0x75, 0x31, 0x93
	};

	unsigned char seq2_ciphertext[] = {
		0x60, 0x87, 0x87, 0x06, 0x11, 0x7f, 0x22, 0x18, 0x0c,
		0x78, 0x8e, 0x62, 0xdf, 0x6a, 0x59, 0x5b, 0xc4, 0x19,
		0x06, 0x09, 0x6a, 0x11, 0xa9, 0x51, 0x3e, 0x84, 0xf0,
		0x14, 0x1e, 0x43, 0x23, 0x9e, 0x81, 0xa9, 0x8d, 0x7a,
		0x23, 0x5a, 0xbc, 0x64, 0x11, 0x2f, 0xcb, 0x8d, 0xdd
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x56, 0xc4, 0xd6, 0xc1, 0xd3, 0xa4, 0x6c, 0x70,
		0xfd, 0x8f, 0x4e, 0xcd, 0xa5, 0xd2, 0x7c, 0x70,
		0x88, 0x6e, 0x34, 0x8e, 0xfb, 0x51, 0xbd, 0x5e,
		0xde, 0xaa, 0x39, 0xff, 0x6c, 0xe3, 0x43, 0x89
	};

	unsigned char expected_exporter_value2[] = {
		0xd2, 0xd3, 0xe4, 0x8e, 0xd7, 0x68, 0x32, 0xb6,
		0xb3, 0xf2, 0x8f, 0xa8, 0x4b, 0xe5, 0xf1, 0x1f,
		0x09, 0x53, 0x3c, 0x0e, 0x3c, 0x71, 0x82, 0x5a,
		0x34, 0xfb, 0x0f, 0x13, 0x20, 0x89, 0x1b, 0x51
	};

	unsigned char expected_exporter_value3[] = {
		0xeb, 0x0d, 0x31, 0x2b, 0x62, 0x63, 0x99, 0x5b,
		0x4c, 0x77, 0x61, 0xe6, 0x4b, 0x68, 0x8c, 0x21,
		0x5f, 0xfd, 0x60, 0x43, 0xff, 0x3b, 0xad, 0x23,
		0x68, 0xc8, 0x62, 0x78, 0x4c, 0xbe, 0x6e, 0xff
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x0e, 0xcd, 0x21, 0x20, 0x19, 0x00, 0x81, 0x38,
		0xa3, 0x1f, 0x91, 0x04, 0xd5, 0xdb, 0xa7, 0x6b,
		0x9f, 0x8e, 0x34, 0xd5, 0xb9, 0x96, 0x04, 0x1f,
		0xff, 0x9e, 0x3d, 0xf2, 0x21, 0xdd, 0x0d, 0x5d
	};

	unsigned char ikmR[] = {
		0xd3, 0x22, 0x36, 0xd8, 0x37, 0x8b, 0x95, 0x63,
		0x84, 0x06, 0x53, 0x78, 0x9e, 0xb7, 0xbc, 0x33,
		0xc3, 0xc7, 0x20, 0xe5, 0x37, 0x39, 0x17, 0x27,
		0xbf, 0x1c, 0x81, 0x2d, 0x0e, 0xac, 0x11, 0x0f
	};

	unsigned char ikmS[] = {
		0x0e, 0x6b, 0xe0, 0x85, 0x12, 0x83, 0xf9, 0x32,
		0x72, 0x95, 0xfd, 0x49, 0x85, 0x8a, 0x8c, 0x89,
		0x08, 0xea, 0x97, 0x83, 0x21, 0x29, 0x45, 0xee,
		0xf6, 0xc5, 0x98, 0xee, 0x0a, 0x3c, 0xed, 0xbb
	};

	unsigned char expected_enc[] = {
		0x04, 0x0d, 0x51, 0x76, 0xae, 0xdb, 0xa5, 0x5b, 0xc4, 0x17,
		0x09, 0x26, 0x1e, 0x91, 0x95, 0xc5, 0x14, 0x6b, 0xb6, 0x2d,
		0x78, 0x30, 0x31, 0x28, 0x07, 0x75, 0xf3, 0x2e, 0x50, 0x7d,
		0x79, 0xb5, 0xcb, 0xc5, 0x74, 0x8b, 0x6b, 0xe6, 0x35, 0x97,
		0x60, 0xc7, 0x3c, 0xfe, 0x10, 0xca, 0x19, 0x52, 0x1a, 0xf7,
		0x04, 0xca, 0x6d, 0x91, 0xff, 0x32, 0xfc, 0x07, 0x39, 0x52,
		0x7b, 0x93, 0x85, 0xd4, 0x15
	};

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a54(void)
{
	unsigned char seq0_ciphertext[] = {
		0x9e, 0xad, 0xfa, 0x0f, 0x95, 0x48, 0x35, 0xe7, 0xe9,
		0x20, 0xff, 0xe5, 0x6d, 0xec, 0x6b, 0x31, 0xa0, 0x46,
		0x27, 0x1c, 0xf7, 0x1f, 0xdd, 0xa5, 0x5d, 0xb7, 0x29,
		0x26, 0xe1, 0xd8, 0xfa, 0xe9, 0x4c, 0xc6, 0x28, 0x0f,
		0xcf, 0xab, 0xd8, 0xdb, 0x71, 0xea, 0xa6, 0x5c, 0x05
	};

	unsigned char seq1_ciphertext[] = {
		0xe3, 0x57, 0xad, 0x10, 0xd7, 0x52, 0x40, 0x22, 0x4d,
		0x40, 0x95, 0xc9, 0xf6, 0x15, 0x0a, 0x2e, 0xd2, 0x17,
		0x9c, 0x0f, 0x87, 0x8e, 0x4f, 0x2d, 0xb8, 0xca, 0x95,
		0xd3, 0x65, 0xd1, 0x74, 0xd0, 0x59, 0xff, 0x8c, 0x3e,
		0xb3, 0x8e, 0xa9, 0xa6, 0x5c, 0xfc, 0x8e, 0xae, 0xb8
	};

	unsigned char seq2_ciphertext[] = {
		0x2f, 0xa5, 0x6d, 0x00, 0xf8, 0xdd, 0x47, 0x9d, 0x67,
		0xa2, 0xec, 0x33, 0x08, 0x32, 0x5c, 0xf3, 0xbb, 0xcc,
		0xaf, 0x10, 0x2a, 0x64, 0xff, 0xcc, 0xdb, 0x00, 0x6b,
		0xd7, 0xdc, 0xb9, 0x32, 0x68, 0x5b, 0x9a, 0x7b, 0x49,
		0xcd, 0xc0, 0x94, 0xa8, 0x5f, 0xec, 0x1d, 0xa5, 0xef
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0xc5, 0x2b, 0x45, 0x92, 0xcd, 0x33, 0xdd, 0x38,
		0xb2, 0xa3, 0x61, 0x31, 0x08, 0xdd, 0xda, 0x28,
		0xdc, 0xf7, 0xf0, 0x3d, 0x30, 0xf2, 0xa0, 0x97,
		0x03, 0xf7, 0x58, 0xbf, 0xa8, 0x02, 0x9c, 0x9a
	};

	unsigned char expected_exporter_value2[] = {
		0x2f, 0x03, 0xbe, 0xbc, 0x57, 0x7e, 0x57, 0x29,
		0xe1, 0x48, 0x55, 0x49, 0x91, 0x78, 0x72, 0x22,
		0xb5, 0xc2, 0xa0, 0x2b, 0x77, 0xe9, 0xb1, 0xac,
		0x38, 0x05, 0x41, 0xf7, 0x10, 0xe5, 0xa3, 0x18
	};

	unsigned char expected_exporter_value3[] = {
		0xe0, 0x1d, 0xd4, 0x9e, 0x8b, 0xfc, 0x3d, 0x92,
		0x16, 0xab, 0xc1, 0xbe, 0x83, 0x2f, 0x04, 0x18,
		0xad, 0xf8, 0xb4, 0x7a, 0x7b, 0x5a, 0x33, 0x0a,
		0x74, 0x36, 0xc3, 0x1e, 0x33, 0xd7, 0x65, 0xd7
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0xf3, 0xa0, 0x7f, 0x19, 0x47, 0x03, 0xe3, 0x21,
		0xef, 0x1f, 0x75, 0x3a, 0x1b, 0x9f, 0xe2, 0x7a,
		0x49, 0x8d, 0xfd, 0xfa, 0x30, 0x91, 0x51, 0xd7,
		0x0b, 0xed, 0xd8, 0x96, 0xc2, 0x39, 0xc4, 0x99
	};

	unsigned char ikmR[] = {
		0x12, 0x40, 0xe5, 0x5a, 0x0a, 0x03, 0x54, 0x8d,
		0x7f, 0x96, 0x3e, 0xf7, 0x83, 0xb6, 0xa7, 0x36,
		0x2c, 0xb5, 0x05, 0xe6, 0xb3, 0x1d, 0xfd, 0x04,
		0xc8, 0x1d, 0x9b, 0x29, 0x45, 0x43, 0xbf, 0xbd
	};

	unsigned char ikmS[] = {
		0xce, 0x2a, 0x03, 0x87, 0xa2, 0xeb, 0x88, 0x70,
		0xa3, 0xa9, 0x2c, 0x34, 0xa2, 0x97, 0x5f, 0x0f,
		0x3f, 0x27, 0x1a, 0xf4, 0x38, 0x4d, 0x44, 0x6c,
		0x7d, 0xc1, 0x52, 0x4a, 0x6c, 0x6c, 0x51, 0x5a
	};

	unsigned char expected_enc[] = {
		0x04, 0x35, 0x39, 0x91, 0x7e, 0xe2, 0x6f, 0x8a, 0xe0, 0xaa,
		0x5f, 0x78, 0x4a, 0x38, 0x79, 0x81, 0xb1, 0x3d, 0xe3, 0x31,
		0x24, 0xa3, 0xcd, 0xe8, 0x8b, 0x94, 0x67, 0x20, 0x30, 0x18,
		0x31, 0x10, 0xf3, 0x31, 0x40, 0x01, 0x15, 0x85, 0x58, 0x08,
		0x24, 0x4f, 0xf0, 0xc5, 0xb6, 0xca, 0x61, 0x04, 0x48, 0x3a,
		0xc9, 0x57, 0x24, 0x48, 0x1d, 0x41, 0xbd, 0xcd, 0x9f, 0x15,
		0xb4, 0x30, 0xad, 0x16, 0xf6
	};

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P256,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_CHACHA20_POLY1305,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a61(void)
{
	unsigned char seq0_ciphertext[] = {
		0x17, 0x0f, 0x8b, 0xed, 0xdf, 0xe9, 0x49, 0xb7, 0x5e,
		0xf9, 0xc3, 0x87, 0xe2, 0x01, 0xba, 0xf4, 0x13, 0x2f,
		0xa7, 0x37, 0x45, 0x93, 0xdf, 0xaf, 0xa9, 0x07, 0x68,
		0x78, 0x8b, 0x7b, 0x2b, 0x20, 0x0a, 0xaf, 0xcc, 0x6d,
		0x80, 0xea, 0x4c, 0x79, 0x5a, 0x7c, 0x5b, 0x84, 0x1a
	};

	unsigned char seq1_ciphertext[] = {
		0xd9, 0xee, 0x24, 0x8e, 0x22, 0x0c, 0xa2, 0x4a, 0xc0,
		0x0b, 0xbb, 0xe7, 0xe2, 0x21, 0xa8, 0x32, 0xe4, 0xf7,
		0xfa, 0x64, 0xc4, 0xfb, 0xab, 0x39, 0x45, 0xb6, 0xf3,
		0xaf, 0x0c, 0x5e, 0xcd, 0x5e, 0x16, 0x81, 0x5b, 0x32,
		0x8b, 0xe4, 0x95, 0x4a, 0x05, 0xfd, 0x35, 0x22, 0x56
	};

	unsigned char seq2_ciphertext[] = {
		0x14, 0x2c, 0xf1, 0xe0, 0x2d, 0x1f, 0x58, 0xd9, 0x28,
		0x5f, 0x2a, 0xf7, 0xdc, 0xfa, 0x44, 0xf7, 0xc3, 0xf2,
		0xd1, 0x5c, 0x73, 0xd4, 0x60, 0xc4, 0x8c, 0x6e, 0x0e,
		0x50, 0x6a, 0x31, 0x44, 0xba, 0xe3, 0x52, 0x84, 0xe7,
		0xe2, 0x21, 0x10, 0x5b, 0x61, 0xd2, 0x4e, 0x1c, 0x7a
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x05, 0xe2, 0xe5, 0xbd, 0x9f, 0x0c, 0x30, 0x83,
		0x2b, 0x80, 0xa2, 0x79, 0xff, 0x21, 0x1c, 0xc6,
		0x5e, 0xce, 0xb0, 0xd9, 0x70, 0x01, 0x52, 0x40,
		0x85, 0xd6, 0x09, 0xea, 0xd6, 0x0d, 0x04, 0x12
	};

	unsigned char expected_exporter_value2[] = {
		0xfc, 0xa6, 0x97, 0x44, 0xbb, 0x53, 0x7f, 0x5b,
		0x7a, 0x15, 0x96, 0xdb, 0xf3, 0x4e, 0xaa, 0x8d,
		0x84, 0xbf, 0x2e, 0x3e, 0xe7, 0xf1, 0xa1, 0x55,
		0xd4, 0x1b, 0xd3, 0x62, 0x4a, 0xa9, 0x2b, 0x63
	};

	unsigned char expected_exporter_value3[] = {
		0xf3, 0x89, 0xbe, 0xaa, 0xc6, 0xfc, 0xf6, 0xc0,
		0xd9, 0x37, 0x6e, 0x20, 0xf9, 0x7e, 0x36, 0x4f,
		0x06, 0x09, 0xa8, 0x8f, 0x1b, 0xc7, 0x6d, 0x73,
		0x28, 0xe9, 0x10, 0x4d, 0xf8, 0x47, 0x70, 0x13
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = { 0x7f, 0x06, 0xab, 0x82, 0x15, 0x10, 0x5f, 0xc4,
				 0x6a, 0xce, 0xeb, 0x2e, 0x3d, 0xc5, 0x02, 0x8b,
				 0x44, 0x36, 0x4f, 0x96, 0x04, 0x26, 0xeb, 0x0d,
				 0x8e, 0x40, 0x26, 0xc2, 0xf8, 0xb5, 0xd7, 0xe7,
				 0xa9, 0x86, 0x68, 0x8f, 0x15, 0x91, 0xab, 0xf5,
				 0xab, 0x75, 0x3c, 0x35, 0x7a, 0x5d, 0x6f, 0x04,
				 0x40, 0x41, 0x4b, 0x4e, 0xd4, 0xed, 0xe7, 0x13,
				 0x17, 0x77, 0x2a, 0xc9, 0x8d, 0x92, 0x39, 0xf7,
				 0x09, 0x04 };

	unsigned char ikmR[] = { 0x2a, 0xd9, 0x54, 0xbb, 0xe3, 0x9b, 0x71, 0x22,
				 0x52, 0x9f, 0x7d, 0xde, 0x78, 0x0b, 0xff, 0x62,
				 0x6c, 0xd9, 0x7f, 0x85, 0x0d, 0x07, 0x84, 0xa4,
				 0x32, 0x78, 0x4e, 0x69, 0xd8, 0x6e, 0xcc, 0xaa,
				 0xde, 0x43, 0xb6, 0xc1, 0x0a, 0x8f, 0xfd, 0xb9,
				 0x4b, 0xf9, 0x43, 0xc6, 0xda, 0x47, 0x9d, 0xb1,
				 0x37, 0x91, 0x4e, 0xc8, 0x35, 0xa7, 0xe7, 0x15,
				 0xe3, 0x6e, 0x45, 0xe2, 0x9b, 0x58, 0x7b, 0xab,
				 0x3b, 0xf1 };

	unsigned char expected_enc[] = {
		0x04, 0x01, 0x38, 0xb3, 0x85, 0xca, 0x16, 0xbb, 0x0d, 0x5f,
		0xa0, 0xc0, 0x66, 0x5f, 0xbb, 0xd7, 0xe6, 0x9e, 0x3e, 0xe2,
		0x9f, 0x63, 0x99, 0x1d, 0x3e, 0x9b, 0x5f, 0xa7, 0x40, 0xaa,
		0xb8, 0x90, 0x0a, 0xae, 0xed, 0x46, 0xed, 0x73, 0xa4, 0x90,
		0x55, 0x75, 0x84, 0x25, 0xa0, 0xce, 0x36, 0x50, 0x7c, 0x54,
		0xb2, 0x9c, 0xc5, 0xb8, 0x5a, 0x5c, 0xee, 0x6b, 0xae, 0x0c,
		0xf1, 0xc2, 0x1f, 0x27, 0x31, 0xec, 0xe2, 0x01, 0x3d, 0xc3,
		0xfb, 0x7c, 0x8d, 0x21, 0x65, 0x4b, 0xb1, 0x61, 0xb4, 0x63,
		0x96, 0x2c, 0xa1, 0x9e, 0x8c, 0x65, 0x4f, 0xf2, 0x4c, 0x94,
		0xdd, 0x28, 0x98, 0xde, 0x12, 0x05, 0x1f, 0x1e, 0xd0, 0x69,
		0x22, 0x37, 0xfb, 0x02, 0xb2, 0xf8, 0xd1, 0xdc, 0x1c, 0x73,
		0xe9, 0xb3, 0x66, 0xb5, 0x29, 0xeb, 0x43, 0x6e, 0x98, 0xa9,
		0x96, 0xee, 0x52, 0x2a, 0xef, 0x86, 0x3d, 0xd5, 0x73, 0x9d,
		0x2f, 0x29, 0xb0
	};

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_BASE,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P521,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
		.aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a62(void)
{
	unsigned char seq0_ciphertext[] = {
		0xde, 0x69, 0xe9, 0xd9, 0x43, 0xa5, 0xd0, 0xb7, 0x0b,
		0xe3, 0x35, 0x9a, 0x19, 0xf3, 0x17, 0xbd, 0x9a, 0xca,
		0x4a, 0x2e, 0xbb, 0x43, 0x32, 0xa3, 0x9b, 0xcd, 0xfc,
		0x97, 0xd5, 0xfe, 0x62, 0xf3, 0xa7, 0x77, 0x02, 0xf4,
		0x82, 0x2c, 0x3b, 0xe5, 0x31, 0xaa, 0x78, 0x43, 0xa1
	};

	unsigned char seq1_ciphertext[] = {
		0x77, 0xa1, 0x61, 0x62, 0x83, 0x1f, 0x90, 0xde, 0x35,
		0x0f, 0xea, 0x91, 0x52, 0xcf, 0xc6, 0x85, 0xec, 0xfa,
		0x10, 0xac, 0xb4, 0xf7, 0x99, 0x4f, 0x41, 0xae, 0xd4,
		0x3f, 0xa5, 0x43, 0x1f, 0x23, 0x82, 0xd0, 0x78, 0xec,
		0x88, 0xba, 0xec, 0x53, 0x94, 0x39, 0x84, 0x55, 0x3e
	};

	unsigned char seq2_ciphertext[] = {
		0xf1, 0xd4, 0x8d, 0x09, 0xf1, 0x26, 0xb9, 0x00, 0x3b,
		0x4c, 0x7d, 0x3f, 0xe6, 0x77, 0x9c, 0x7c, 0x92, 0x17,
		0x31, 0x88, 0xa2, 0xbb, 0x74, 0x65, 0xba, 0x43, 0xd8,
		0x99, 0xa6, 0x39, 0x8a, 0x33, 0x39, 0x14, 0xd2, 0xbb,
		0x19, 0xfd, 0x76, 0x9d, 0x53, 0xf3, 0xec, 0x73, 0x36
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x62, 0x69, 0x1f, 0x0f, 0x97, 0x1e, 0x34, 0xde,
		0x38, 0x37, 0x0b, 0xff, 0x24, 0xde, 0xb5, 0xa7,
		0xd4, 0x0a, 0xb6, 0x28, 0x09, 0x3d, 0x30, 0x4b,
		0xe6, 0x09, 0x46, 0xaf, 0xcd, 0xb3, 0xa9, 0x36
	};

	unsigned char expected_exporter_value2[] = {
		0x76, 0x08, 0x3c, 0x6d, 0x1b, 0x68, 0x09, 0xda,
		0x08, 0x85, 0x84, 0x67, 0x43, 0x27, 0xb3, 0x94,
		0x88, 0xea, 0xf6, 0x65, 0xf0, 0x73, 0x11, 0x51,
		0x12, 0x84, 0x52, 0xe0, 0x4c, 0xe8, 0x1b, 0xff
	};

	unsigned char expected_exporter_value3[] = {
		0x0c, 0x7c, 0xfc, 0x09, 0x76, 0xe2, 0x5a, 0xe7,
		0x68, 0x0c, 0xf9, 0x09, 0xae, 0x2d, 0xe1, 0x85,
		0x9c, 0xd9, 0xb6, 0x79, 0x61, 0x0a, 0x14, 0xbe,
		0xc4, 0x0d, 0x69, 0xb9, 0x17, 0x85, 0xb2, 0xf6
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = { 0xf3, 0xeb, 0xfa, 0x9a, 0x69, 0xa9, 0x24, 0xe6,
				 0x72, 0x11, 0x4f, 0xcd, 0x9e, 0x06, 0xfa, 0x95,
				 0x59, 0xe9, 0x37, 0xf7, 0xec, 0xcc, 0xe4, 0x18,
				 0x1a, 0x2b, 0x50, 0x6d, 0xf5, 0x3d, 0xbe, 0x51,
				 0x4b, 0xe1, 0x2f, 0x09, 0x4b, 0xb2, 0x8e, 0x01,
				 0xde, 0x19, 0xdd, 0x34, 0x5b, 0x4f, 0x7e, 0xde,
				 0x5a, 0xd7, 0xea, 0xa6, 0xb9, 0xc3, 0x01, 0x95,
				 0x92, 0xec, 0x68, 0xea, 0xae, 0x9a, 0x14, 0x73,
				 0x2c, 0xe0 };

	unsigned char ikmR[] = { 0xa2, 0xa2, 0x45, 0x87, 0x05, 0xe2, 0x78, 0xe5,
				 0x74, 0xf8, 0x35, 0xef, 0xfe, 0xcd, 0x18, 0x23,
				 0x2f, 0x8a, 0x4c, 0x45, 0x9e, 0x75, 0x50, 0xa0,
				 0x9d, 0x44, 0x34, 0x8a, 0xe5, 0xd3, 0xb1, 0xea,
				 0x9d, 0x95, 0xc5, 0x19, 0x95, 0xe6, 0x57, 0xad,
				 0x6f, 0x7c, 0xae, 0x65, 0x9f, 0x5e, 0x18, 0x61,
				 0x26, 0xa4, 0x71, 0xc0, 0x17, 0xf8, 0xf5, 0xe4,
				 0x1d, 0xa9, 0xeb, 0xa7, 0x4d, 0x4e, 0x04, 0x73,
				 0xe1, 0x79 };

	unsigned char expected_enc[] = {
		0x04, 0x00, 0x85, 0xef, 0xf0, 0x83, 0x5c, 0xc8, 0x43, 0x51,
		0xf3, 0x24, 0x71, 0xd3, 0x2a, 0xa4, 0x53, 0xcd, 0xc1, 0xf6,
		0x41, 0x8e, 0xaa, 0xec, 0xf1, 0xc2, 0x82, 0x42, 0x10, 0xeb,
		0x1d, 0x48, 0xd0, 0x76, 0x8b, 0x36, 0x81, 0x10, 0xfa, 0xb2,
		0x14, 0x07, 0xc3, 0x24, 0xb8, 0xbb, 0x4b, 0xec, 0x63, 0xf0,
		0x42, 0xcf, 0xa4, 0xd0, 0x86, 0x8d, 0x19, 0xb7, 0x60, 0xeb,
		0x4b, 0xeb, 0xa1, 0xbf, 0xf7, 0x93, 0xb3, 0x00, 0x36, 0xd2,
		0xc6, 0x14, 0xd5, 0x57, 0x30, 0xbd, 0x2a, 0x40, 0xc7, 0x18,
		0xf9, 0x46, 0x6f, 0xaf, 0x4d, 0x5f, 0x81, 0x70, 0xd2, 0x2b,
		0x6d, 0xf9, 0x8d, 0xfe, 0x0c, 0x06, 0x7d, 0x02, 0xb3, 0x49,
		0xae, 0x4a, 0x14, 0x2e, 0x0c, 0x03, 0x41, 0x8f, 0x0a, 0x14,
		0x79, 0xff, 0x78, 0xa3, 0xdb, 0x07, 0xae, 0x2c, 0x2e, 0x89,
		0xe5, 0x84, 0x0f, 0x71, 0x2c, 0x17, 0x4b, 0xa2, 0x11, 0x8e,
		0x90, 0xfd, 0xcb
	};

	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P521,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
		.aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a63(void)
{
	unsigned char seq0_ciphertext[] = {
		0x01, 0x16, 0xae, 0xb3, 0xa1, 0xc4, 0x05, 0xc6, 0x1b,
		0x1c, 0xe4, 0x76, 0x00, 0xb7, 0xec, 0xd1, 0x1d, 0x89,
		0xb9, 0xc0, 0x8c, 0x40, 0x8b, 0x7e, 0x2d, 0x1e, 0x00,
		0xa4, 0xd6, 0x46, 0x96, 0xd1, 0x2e, 0x68, 0x81, 0xdc,
		0x61, 0x68, 0x82, 0x09, 0xa8, 0x20, 0x74, 0x27, 0xf9
	};

	unsigned char seq1_ciphertext[] = {
		0x37, 0xec, 0xe0, 0xcf, 0x67, 0x41, 0xf4, 0x43, 0xe9,
		0xd7, 0x3b, 0x99, 0x66, 0xdc, 0x0b, 0x22, 0x84, 0x99,
		0xbb, 0x21, 0xfb, 0xf3, 0x13, 0x94, 0x83, 0x27, 0x23,
		0x1e, 0x70, 0xa1, 0x83, 0x80, 0xe0, 0x80, 0x52, 0x9c,
		0x02, 0x67, 0xf3, 0x99, 0xba, 0x7c, 0x53, 0x9c, 0xc6
	};

	unsigned char seq2_ciphertext[] = {
		0xd1, 0x7b, 0x04, 0x5c, 0xac, 0x96, 0x3e, 0x45, 0xd5,
		0x5f, 0xd3, 0x69, 0x2e, 0xc1, 0x7f, 0x10, 0x0d, 0xf6,
		0x6a, 0xc0, 0x6d, 0x91, 0xf3, 0xb6, 0xaf, 0x8e, 0xfa,
		0x7e, 0xd3, 0xc8, 0x89, 0x55, 0x50, 0xeb, 0x75, 0x3b,
		0xc8, 0x01, 0xfe, 0x4b, 0xd2, 0x70, 0x05, 0xb4, 0xbd
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0x8d, 0x78, 0x74, 0x8d, 0x63, 0x2f, 0x95, 0xb8,
		0xce, 0x0c, 0x67, 0xd7, 0x0f, 0x4a, 0xd1, 0x75,
		0x7e, 0x61, 0xe8, 0x72, 0xb5, 0x94, 0x1e, 0x14,
		0x69, 0x86, 0x80, 0x4b, 0x39, 0x90, 0x15, 0x4b
	};

	unsigned char expected_exporter_value2[] = {
		0x80, 0xa4, 0x75, 0x32, 0x30, 0x90, 0x0e, 0xa7,
		0x85, 0xb6, 0xc8, 0x07, 0x75, 0x09, 0x28, 0x01,
		0xfe, 0x91, 0x18, 0x37, 0x46, 0x47, 0x9f, 0x9b,
		0x04, 0xc3, 0x05, 0xe1, 0xdb, 0x9d, 0x1f, 0x4d
	};

	unsigned char expected_exporter_value3[] = {
		0x62, 0x0b, 0x17, 0x6d, 0x73, 0x7c, 0xf3, 0x66,
		0xbc, 0xc2, 0x0d, 0x96, 0xad, 0xb5, 0x4e, 0xc1,
		0x56, 0x97, 0x82, 0x20, 0x87, 0x9b, 0x67, 0x92,
		0x36, 0x89, 0xe6, 0xdc, 0xa3, 0x62, 0x10, 0xed
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = { 0xfe, 0x1c, 0x58, 0x9c, 0x2a, 0x05, 0x89, 0x38,
				 0x95, 0xa5, 0x37, 0xf3, 0x8c, 0x7c, 0xb4, 0x30,
				 0x0b, 0x5a, 0x7e, 0x8f, 0xef, 0x3d, 0x6c, 0xcb,
				 0x8f, 0x07, 0xa4, 0x98, 0x02, 0x9c, 0x61, 0xe9,
				 0x02, 0x62, 0xe0, 0x09, 0xdc, 0x25, 0x4c, 0x7f,
				 0x62, 0x35, 0xf9, 0xc6, 0xb2, 0xfd, 0x6a, 0xef,
				 0xf0, 0xa7, 0x14, 0xdb, 0x13, 0x1b, 0x09, 0x25,
				 0x8c, 0x16, 0xe2, 0x17, 0xb7, 0xbd, 0x2a, 0xa6,
				 0x19, 0xb0 };

	unsigned char ikmR[] = { 0x8f, 0xee, 0xa0, 0x43, 0x84, 0x81, 0xfc, 0x0e,
				 0xcd, 0x47, 0x0d, 0x6a, 0xdf, 0xcd, 0xa3, 0x34,
				 0xa7, 0x59, 0xc6, 0xb8, 0x65, 0x04, 0x52, 0xc5,
				 0xa5, 0xdd, 0x9b, 0x2d, 0xd2, 0xcc, 0x9b, 0xe3,
				 0x3d, 0x2b, 0xb7, 0xee, 0x64, 0x60, 0x5f, 0xc0,
				 0x7a, 0xb4, 0x66, 0x4a, 0x58, 0xbb, 0x9a, 0x8d,
				 0xe8, 0x0d, 0xef, 0xe5, 0x10, 0xb6, 0xc9, 0x7d,
				 0x2d, 0xaf, 0x85, 0xb9, 0x2c, 0xd4, 0xbb, 0x0a,
				 0x66, 0xbf };

	unsigned char ikmS[] = { 0x2f, 0x66, 0xa6, 0x8b, 0x85, 0xef, 0x04, 0x82,
				 0x2b, 0x05, 0x4e, 0xf5, 0x21, 0x83, 0x8c, 0x00,
				 0xc6, 0x4f, 0x8b, 0x62, 0x26, 0x93, 0x55, 0x93,
				 0xb6, 0x9e, 0x13, 0xa1, 0xa2, 0x46, 0x1a, 0x4f,
				 0x1a, 0x74, 0xc1, 0x0c, 0x83, 0x6e, 0x87, 0xee,
				 0xd1, 0x50, 0xc0, 0xdb, 0x85, 0xd4, 0xe4, 0xf5,
				 0x06, 0xcb, 0xb7, 0x46, 0x14, 0x9b, 0xef, 0xac,
				 0x6f, 0x5c, 0x07, 0xdc, 0x48, 0xa6, 0x15, 0xef,
				 0x92, 0xdb };

	unsigned char expected_enc[] = {
		0x04, 0x01, 0x7d, 0xe1, 0x2e, 0xde, 0x7f, 0x72, 0xcb, 0x10,
		0x1d, 0xab, 0x36, 0xa1, 0x11, 0x26, 0x5c, 0x97, 0xb3, 0x65,
		0x48, 0x16, 0xdc, 0xd6, 0x18, 0x3f, 0x80, 0x9d, 0x4b, 0x3d,
		0x11, 0x1f, 0xe7, 0x59, 0x49, 0x7f, 0x8a, 0xef, 0xdc, 0x5d,
		0xbb, 0x40, 0xd3, 0xe6, 0xd2, 0x1d, 0xb1, 0x5b, 0xdc, 0x60,
		0xf1, 0x5f, 0x2a, 0x42, 0x07, 0x61, 0xbc, 0xae, 0xef, 0x73,
		0xb8, 0x91, 0xc2, 0xb1, 0x17, 0xe9, 0xcf, 0x01, 0xe2, 0x93,
		0x20, 0xb7, 0x99, 0xbb, 0xc8, 0x6a, 0xfd, 0xc5, 0xea, 0x97,
		0xd9, 0x41, 0xea, 0x1c, 0x5b, 0xd5, 0xeb, 0xee, 0xac, 0x7a,
		0x78, 0x4b, 0x3b, 0xab, 0x52, 0x47, 0x46, 0xf3, 0xe6, 0x40,
		0xec, 0x26, 0xee, 0x1b, 0xd9, 0x12, 0x55, 0xf9, 0x33, 0x0d,
		0x97, 0x4f, 0x84, 0x50, 0x84, 0x63, 0x7e, 0xe0, 0xe6, 0xfe,
		0x9f, 0x50, 0x5c, 0x5b, 0x87, 0xc8, 0x6a, 0x4e, 0x1a, 0x6c,
		0x30, 0x96, 0xdd
	};

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P521,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
		.aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a64(void)
{
	unsigned char seq0_ciphertext[] = {
		0x94, 0x2a, 0x2a, 0x92, 0xe0, 0x81, 0x7c, 0xf0, 0x32,
		0xce, 0x61, 0xab, 0xcc, 0xf4, 0xf3, 0xa7, 0xc5, 0xd2,
		0x1b, 0x79, 0x4e, 0xd9, 0x43, 0x22, 0x7e, 0x07, 0xb7,
		0xdf, 0x2d, 0x6d, 0xd9, 0x2c, 0x9b, 0x8a, 0x93, 0x71,
		0x94, 0x9e, 0x65, 0xcc, 0xa2, 0x62, 0x44, 0x8a, 0xb7
	};

	unsigned char seq1_ciphertext[] = {
		0xc0, 0xa8, 0x3b, 0x5e, 0xc3, 0xd7, 0x93, 0x3a, 0x09,
		0x0f, 0x68, 0x17, 0x17, 0x29, 0x03, 0x37, 0xb4, 0xfe,
		0xde, 0x5b, 0xfa, 0xa0, 0xa4, 0x0e, 0xc2, 0x9f, 0x93,
		0xac, 0xad, 0x74, 0x28, 0x88, 0xa1, 0x51, 0x3c, 0x64,
		0x91, 0x04, 0xc3, 0x91, 0xc7, 0x8d, 0x1d, 0x7f, 0x29
	};

	unsigned char seq2_ciphertext[] = {
		0x28, 0x47, 0xb2, 0xe0, 0xce, 0x0b, 0x9d, 0xa8, 0xfc,
		0xa7, 0xb0, 0xe8, 0x1f, 0xf3, 0x89, 0xd1, 0x68, 0x2e,
		0xe1, 0xb3, 0x88, 0xed, 0x09, 0x57, 0x9b, 0x14, 0x50,
		0x58, 0xb5, 0xaf, 0x6a, 0x93, 0xa8, 0x5d, 0xd5, 0x0d,
		0x9f, 0x41, 0x7d, 0xc8, 0x8f, 0x2c, 0x78, 0x53, 0x12
	};

	hpke_test_encryption_parameters_st enc_params[] = {
		{ .sequence_number = 0,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq0_aad, sizeof(seq0_aad) },
		  .expected_ciphertext = { seq0_ciphertext,
					   sizeof(seq0_ciphertext) } },
		{ .sequence_number = 1,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq1_aad, sizeof(seq1_aad) },
		  .expected_ciphertext = { seq1_ciphertext,
					   sizeof(seq1_ciphertext) } },
		{ .sequence_number = 2,
		  .plaintext = { plaintext, sizeof(plaintext) },
		  .aad = { seq2_aad, sizeof(seq2_aad) },
		  .expected_ciphertext = { seq2_ciphertext,
					   sizeof(seq2_ciphertext) } }
	};

	unsigned char expected_exporter_value1[] = {
		0xa3, 0x95, 0x02, 0xef, 0x5c, 0xa1, 0x16, 0xaa,
		0x13, 0x17, 0xbd, 0x95, 0x83, 0xdd, 0x52, 0xf1,
		0x5b, 0x05, 0x02, 0xb7, 0x1d, 0x90, 0x0f, 0xc8,
		0xa6, 0x22, 0xd1, 0x96, 0x23, 0xd0, 0xcb, 0x5d
	};

	unsigned char expected_exporter_value2[] = {
		0x74, 0x9e, 0xda, 0x11, 0x2c, 0x4c, 0xfd, 0xd6,
		0x67, 0x1d, 0x84, 0x59, 0x5f, 0x12, 0xcd, 0x13,
		0x19, 0x8f, 0xc3, 0xef, 0x93, 0xed, 0x72, 0x36,
		0x91, 0x78, 0xf3, 0x44, 0xfe, 0x6e, 0x09, 0xc3
	};

	unsigned char expected_exporter_value3[] = {
		0xf8, 0xb4, 0xe7, 0x2c, 0xef, 0xbf, 0xf4, 0xca,
		0x6c, 0x4e, 0xab, 0xb8, 0xc0, 0x38, 0x32, 0x87,
		0x08, 0x2c, 0xfc, 0xbb, 0x95, 0x3d, 0x90, 0x0a,
		0xed, 0x49, 0x59, 0xaf, 0xd0, 0x01, 0x70, 0x95
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = { 0x54, 0x27, 0x27, 0x97, 0xb1, 0xfb, 0xc1, 0x28,
				 0xa6, 0x96, 0x7f, 0xf1, 0xfd, 0x60, 0x6e, 0x0c,
				 0x67, 0x86, 0x8f, 0x77, 0x62, 0xce, 0x14, 0x21,
				 0x43, 0x9c, 0xbc, 0x9e, 0x90, 0xce, 0x1b, 0x28,
				 0xd5, 0x66, 0xe6, 0xc2, 0xac, 0xbc, 0xe7, 0x12,
				 0xe4, 0x8e, 0xeb, 0xf2, 0x36, 0x69, 0x6e, 0xb6,
				 0x80, 0x84, 0x9d, 0x68, 0x73, 0xe9, 0x95, 0x93,
				 0x95, 0xb2, 0x93, 0x19, 0x75, 0xd6, 0x1d, 0x38,
				 0xbd, 0x6c };

	unsigned char ikmR[] = { 0x3d, 0xb4, 0x34, 0xa8, 0xbc, 0x25, 0xb2, 0x7e,
				 0xb0, 0xc5, 0x90, 0xdc, 0x64, 0x99, 0x7a, 0xb1,
				 0x37, 0x8a, 0x99, 0xf5, 0x2b, 0x2c, 0xb5, 0xa5,
				 0xa5, 0xb2, 0xfa, 0x54, 0x08, 0x88, 0xf6, 0xc0,
				 0xf0, 0x97, 0x94, 0xc6, 0x54, 0xf4, 0x46, 0x85,
				 0x24, 0xe0, 0x40, 0xe6, 0xb4, 0xec, 0xa2, 0xc9,
				 0xdc, 0xf2, 0x29, 0xf9, 0x08, 0xb9, 0xd3, 0x18,
				 0xf9, 0x60, 0xcc, 0x9e, 0x9b, 0xaa, 0x92, 0xc5,
				 0xee, 0xe6 };

	unsigned char ikmS[] = { 0x65, 0xd5, 0x23, 0xd9, 0xb3, 0x7e, 0x12, 0x73,
				 0xeb, 0x25, 0xad, 0x05, 0x27, 0xd3, 0xa7, 0xbd,
				 0x33, 0xf6, 0x72, 0x08, 0xdd, 0x16, 0x66, 0xd9,
				 0x90, 0x4c, 0x6b, 0xc0, 0x49, 0x69, 0xae, 0x58,
				 0x31, 0xa8, 0xb8, 0x49, 0xe7, 0xff, 0x64, 0x25,
				 0x81, 0xf2, 0xc3, 0xe5, 0x6b, 0xe8, 0x46, 0x09,
				 0x60, 0x0d, 0x3c, 0x6b, 0xbd, 0xad, 0xed, 0x3f,
				 0x69, 0x89, 0xc3, 0x7d, 0x28, 0x92, 0xb1, 0xe9,
				 0x78, 0xd5 };

	unsigned char expected_enc[] = {
		0x04, 0x00, 0x0a, 0x50, 0x96, 0xa6, 0xe6, 0xe0, 0x02, 0xc8,
		0x35, 0x17, 0xb4, 0x94, 0xbf, 0xc2, 0xe3, 0x6b, 0xfb, 0x86,
		0x32, 0xfa, 0xe8, 0x06, 0x83, 0x62, 0x85, 0x2b, 0x70, 0xd0,
		0xff, 0x71, 0xe5, 0x60, 0xb1, 0x5a, 0xff, 0x96, 0x74, 0x1e,
		0xcf, 0xfb, 0x63, 0xd8, 0xac, 0x30, 0x90, 0xc3, 0x76, 0x96,
		0x79, 0x00, 0x9a, 0xc5, 0x9a, 0x99, 0xa1, 0xfe, 0xb4, 0x71,
		0x3c, 0x5f, 0x09, 0x0f, 0xc0, 0xdb, 0xed, 0x01, 0xad, 0x73,
		0xc4, 0x5d, 0x29, 0xd3, 0x69, 0xe3, 0x67, 0x44, 0xe9, 0xed,
		0x37, 0xd1, 0x2f, 0x80, 0x70, 0x0c, 0x16, 0xd8, 0x16, 0x48,
		0x56, 0x55, 0x16, 0x9a, 0x5d, 0xd6, 0x6e, 0x4d, 0xdf, 0x27,
		0xf2, 0xac, 0xff, 0xe0, 0xf5, 0x6f, 0x7f, 0x77, 0xea, 0x2b,
		0x47, 0x3b, 0x4b, 0xf0, 0x51, 0x8b, 0x97, 0x5d, 0x95, 0x27,
		0x00, 0x9a, 0x3d, 0x14, 0xe5, 0xa4, 0x95, 0x7e, 0x3e, 0x8a,
		0x90, 0x74, 0xf8
	};

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_P521,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA512,
		.aead = GNUTLS_HPKE_AEAD_AES_256_GCM,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = enc_params,
		.num_encryption_parameters =
			sizeof(enc_params) / sizeof(enc_params[0]),
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a71(void)
{
	unsigned char expected_exporter_value1[] = {
		0x7a, 0x36, 0x22, 0x1b, 0xd5, 0x6d, 0x50, 0xfb,
		0x51, 0xee, 0x65, 0xed, 0xfd, 0x98, 0xd0, 0x6a,
		0x23, 0xc4, 0xdc, 0x87, 0x08, 0x5a, 0xa5, 0x86,
		0x6c, 0xb7, 0x08, 0x72, 0x44, 0xbd, 0x2a, 0x36
	};

	unsigned char expected_exporter_value2[] = {
		0xd5, 0x53, 0x5b, 0x87, 0x09, 0x9c, 0x6c, 0x3c,
		0xe8, 0x0d, 0xc1, 0x12, 0xa2, 0x67, 0x1c, 0x6e,
		0xc8, 0xe8, 0x11, 0xa2, 0xf2, 0x84, 0xf9, 0x48,
		0xce, 0xc6, 0xdd, 0x17, 0x08, 0xee, 0x33, 0xf0
	};

	unsigned char expected_exporter_value3[] = {
		0xff, 0xaa, 0xbc, 0x85, 0xa7, 0x76, 0x13, 0x6c,
		0xa0, 0xc3, 0x78, 0xe5, 0xd0, 0x84, 0xc9, 0x14,
		0x0a, 0xb5, 0x52, 0xb7, 0x8f, 0x03, 0x9d, 0x2e,
		0x87, 0x75, 0xf2, 0x6e, 0xff, 0xf4, 0xc7, 0x0e
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x55, 0xbc, 0x24, 0x5e, 0xe4, 0xef, 0xda, 0x25,
		0xd3, 0x8f, 0x2d, 0x54, 0xd5, 0xbb, 0x66, 0x65,
		0x29, 0x1b, 0x99, 0xf8, 0x10, 0x8a, 0x8c, 0x4b,
		0x68, 0x6c, 0x2b, 0x14, 0x89, 0x3e, 0xa5, 0xd9
	};

	unsigned char ikmR[] = {
		0x68, 0x3a, 0xe0, 0xda, 0x1d, 0x22, 0x18, 0x1e,
		0x74, 0xed, 0x2e, 0x50, 0x3e, 0xbf, 0x82, 0x84,
		0x0d, 0xeb, 0x1d, 0x5e, 0x87, 0x2c, 0xad, 0xe2,
		0x0f, 0x4b, 0x45, 0x8d, 0x99, 0x78, 0x3e, 0x31
	};

	unsigned char expected_enc[] = { 0xe5, 0xe8, 0xf9, 0xbf, 0xff, 0x6c,
					 0x2f, 0x29, 0x79, 0x1f, 0xc3, 0x51,
					 0xd2, 0xc2, 0x5c, 0xe1, 0x29, 0x9a,
					 0xa5, 0xea, 0xca, 0x78, 0xa7, 0x57,
					 0xc0, 0xb4, 0xfb, 0x4b, 0xcd, 0x83,
					 0x09, 0x18 };

	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_BASE,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = NULL,
		.num_encryption_parameters = 0,
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a72(void)
{
	unsigned char expected_exporter_value1[] = {
		0xbe, 0x6c, 0x76, 0x95, 0x53, 0x34, 0x37, 0x6a,
		0xa2, 0x3e, 0x93, 0x6b, 0xe0, 0x13, 0xba, 0x8b,
		0xba, 0xe9, 0x0a, 0xe7, 0x4e, 0xd9, 0x95, 0xc1,
		0xc6, 0x15, 0x7e, 0x6f, 0x08, 0xdd, 0x53, 0x16
	};

	unsigned char expected_exporter_value2[] = {
		0x17, 0x21, 0xed, 0x2a, 0xa8, 0x52, 0xf8, 0x4d,
		0x44, 0xad, 0x02, 0x0c, 0x2e, 0x2b, 0xe4, 0xe2,
		0xe6, 0x37, 0x50, 0x98, 0xbf, 0x48, 0x77, 0x5a,
		0x53, 0x35, 0x05, 0xfd, 0x56, 0xa3, 0xf4, 0x16
	};

	unsigned char expected_exporter_value3[] = {
		0x7c, 0x9d, 0x79, 0x87, 0x6a, 0x28, 0x85, 0x07,
		0xb8, 0x1a, 0x5a, 0x52, 0x36, 0x5a, 0x7d, 0x39,
		0xcc, 0x0f, 0xa3, 0xf0, 0x7e, 0x34, 0x17, 0x29,
		0x84, 0xf9, 0x6f, 0xec, 0x07, 0xc4, 0x4c, 0xba
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0xc5, 0x12, 0x11, 0xa8, 0x79, 0x9f, 0x6b, 0x8a,
		0x00, 0x21, 0xfc, 0xba, 0x67, 0x3d, 0x9c, 0x40,
		0x67, 0xa9, 0x8e, 0xbc, 0x67, 0x94, 0x23, 0x2e,
		0x5b, 0x06, 0xcb, 0x9f, 0xeb, 0xcb, 0xbd, 0xf5
	};

	unsigned char ikmR[] = {
		0x5e, 0x05, 0x16, 0xb1, 0xb2, 0x9c, 0x0e, 0x13,
		0x38, 0x65, 0x29, 0xda, 0x16, 0x52, 0x52, 0x10,
		0xc7, 0x96, 0xf7, 0xd6, 0x47, 0xc3, 0x7e, 0xac,
		0x11, 0x80, 0x23, 0xa6, 0xaa, 0x9e, 0xb8, 0x9a
	};

	unsigned char expected_enc[] = { 0xd3, 0x80, 0x5a, 0x97, 0xcb, 0xcd,
					 0x5f, 0x08, 0xba, 0xbd, 0x21, 0x22,
					 0x1d, 0x3e, 0x6b, 0x36, 0x2a, 0x70,
					 0x05, 0x72, 0xd1, 0x4f, 0x9b, 0xbe,
					 0xb9, 0x4e, 0xc0, 0x78, 0xd0, 0x51,
					 0xae, 0x3d };

	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = NULL,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = NULL,
		.num_encryption_parameters = 0,
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a73(void)
{
	unsigned char expected_exporter_value1[] = {
		0x83, 0xc1, 0xba, 0xc0, 0x0a, 0x45, 0xed, 0x4c,
		0xb6, 0xbd, 0x8a, 0x60, 0x07, 0xd2, 0xce, 0x4e,
		0xc5, 0x01, 0xf5, 0x5e, 0x48, 0x5c, 0x56, 0x42,
		0xbd, 0x01, 0xbf, 0x6b, 0x6d, 0x7d, 0x6f, 0x0a
	};

	unsigned char expected_exporter_value2[] = {
		0x08, 0xa1, 0xd1, 0xad, 0x2a, 0xf3, 0xef, 0x5b,
		0xc4, 0x02, 0x32, 0xa6, 0x4f, 0x92, 0x06, 0x50,
		0xeb, 0x9b, 0x10, 0x34, 0xfa, 0xc3, 0x89, 0x2f,
		0x72, 0x9f, 0x79, 0x49, 0x62, 0x1b, 0xf0, 0x6e
	};

	unsigned char expected_exporter_value3[] = {
		0xff, 0x3b, 0x0e, 0x37, 0xa9, 0x95, 0x42, 0x47,
		0xfe, 0xa5, 0x3f, 0x25, 0x1b, 0x79, 0x9e, 0x2e,
		0xdd, 0x35, 0xaa, 0xc7, 0x15, 0x2c, 0x57, 0x95,
		0x75, 0x1a, 0x3d, 0xa4, 0x24, 0xfe, 0xca, 0x73
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x43, 0xb0, 0x78, 0x91, 0x2a, 0x54, 0xb5, 0x91,
		0xa7, 0xb0, 0x9b, 0x16, 0xce, 0x89, 0xa1, 0x95,
		0x5a, 0x9d, 0xd6, 0x0b, 0x29, 0xfb, 0x61, 0x1e,
		0x04, 0x42, 0x60, 0x04, 0x6e, 0x8b, 0x06, 0x1b
	};

	unsigned char ikmR[] = {
		0xfc, 0x94, 0x07, 0xae, 0x72, 0xed, 0x61, 0x49,
		0x01, 0xeb, 0xf4, 0x42, 0x57, 0xfb, 0x54, 0x0f,
		0x61, 0x72, 0x84, 0xb5, 0x36, 0x1c, 0xfe, 0xcd,
		0x62, 0x0b, 0xaf, 0xc4, 0xab, 0xa3, 0x6f, 0x73
	};

	unsigned char ikmS[] = {
		0x2f, 0xf4, 0xc3, 0x7a, 0x17, 0xb2, 0xe5, 0x40,
		0x46, 0xa0, 0x76, 0xbf, 0x5f, 0xea, 0x9c, 0x3d,
		0x59, 0x25, 0x0d, 0x54, 0xd0, 0xdc, 0x85, 0x72,
		0xbc, 0x5f, 0x7c, 0x04, 0x63, 0x07, 0x04, 0x0c
	};

	unsigned char expected_enc[] = { 0x5a, 0xc1, 0x67, 0x1a, 0x55, 0xc5,
					 0xc3, 0x87, 0x5a, 0x8a, 0xfe, 0x74,
					 0x66, 0x4a, 0xa8, 0xbc, 0x68, 0x83,
					 0x0b, 0xe9, 0xde, 0xd0, 0xc5, 0xf6,
					 0x33, 0xcd, 0x96, 0x40, 0x0e, 0x8b,
					 0x5c, 0x05 };

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = NULL,
		.psk_id = NULL,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = NULL,
		.num_encryption_parameters = 0,
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

static void rfc9180_a74(void)
{
	unsigned char expected_exporter_value1[] = {
		0xda, 0xfd, 0x8b, 0xeb, 0x94, 0xc5, 0x80, 0x25,
		0x35, 0xc2, 0x2f, 0xf4, 0xc1, 0xaf, 0x89, 0x46,
		0xc9, 0x8d, 0xf2, 0xc4, 0x17, 0xe1, 0x87, 0xc6,
		0xcc, 0xaf, 0xe4, 0x53, 0x35, 0x81, 0x0b, 0x58
	};

	unsigned char expected_exporter_value2[] = {
		0x73, 0x46, 0xbb, 0x0b, 0x56, 0xca, 0xf4, 0x57,
		0xbc, 0xc1, 0xaa, 0x63, 0xc1, 0xb9, 0x7d, 0x98,
		0x34, 0x64, 0x4b, 0xda, 0xca, 0xc8, 0xf7, 0x2d,
		0xbb, 0xe3, 0x46, 0x3e, 0x4e, 0x46, 0xb0, 0xdd
	};

	unsigned char expected_exporter_value3[] = {
		0x84, 0xf3, 0x46, 0x6b, 0xd5, 0xa0, 0x3b, 0xde,
		0x64, 0x44, 0x32, 0x4e, 0x63, 0xd7, 0x56, 0x0e,
		0x7a, 0xc7, 0x90, 0xda, 0x4e, 0x5b, 0xba, 0xb0,
		0x1e, 0x7c, 0x4d, 0x57, 0x57, 0x28, 0xc3, 0x4a
	};

	hpke_test_exporter_parameters_st exporter_params[] = {
		{ .exporter_context = { exporter_context_1,
					sizeof(exporter_context_1) },
		  .exporter_length = sizeof(expected_exporter_value1),
		  .expected_exporter_value = { expected_exporter_value1,
					       sizeof(expected_exporter_value1) } },
		{ .exporter_context = { exporter_context_2,
					sizeof(exporter_context_2) },
		  .exporter_length = sizeof(expected_exporter_value2),
		  .expected_exporter_value = { expected_exporter_value2,
					       sizeof(expected_exporter_value2) } },
		{ .exporter_context = { exporter_context_3,
					sizeof(exporter_context_3) },
		  .exporter_length = sizeof(expected_exporter_value3),
		  .expected_exporter_value = { expected_exporter_value3,
					       sizeof(expected_exporter_value3) } }
	};

	unsigned char ikmE[] = {
		0x94, 0xef, 0xae, 0x91, 0xe9, 0x68, 0x11, 0xa3,
		0xa4, 0x9f, 0xd1, 0xb2, 0x0e, 0xb0, 0x34, 0x4d,
		0x68, 0xea, 0xd6, 0xac, 0x01, 0x92, 0x2c, 0x23,
		0x60, 0x77, 0x9a, 0xa1, 0x72, 0x48, 0x7f, 0x40
	};

	unsigned char ikmR[] = {
		0x4d, 0xfd, 0xe6, 0xfa, 0xdf, 0xe5, 0xcb, 0x50,
		0xfc, 0xed, 0x40, 0x34, 0xe8, 0x4e, 0x6d, 0x3a,
		0x10, 0x4a, 0xa4, 0xbf, 0x29, 0x71, 0x36, 0x00,
		0x32, 0xc1, 0xc0, 0x58, 0x0e, 0x28, 0x66, 0x63
	};

	unsigned char ikmS[] = {
		0x26, 0xc1, 0x2f, 0xef, 0x8d, 0x71, 0xd1, 0x3b,
		0xbb, 0xf0, 0x8c, 0xe8, 0x15, 0x7a, 0x28, 0x3d,
		0x5e, 0x67, 0xec, 0xf0, 0xf3, 0x45, 0x36, 0x6b,
		0x0e, 0x90, 0x34, 0x19, 0x11, 0x11, 0x0f, 0x1b
	};

	unsigned char expected_enc[] = { 0x81, 0xcb, 0xf4, 0xbd, 0x7e, 0xee,
					 0x97, 0xdd, 0x0b, 0x60, 0x02, 0x52,
					 0xa1, 0xc9, 0x64, 0xea, 0x18, 0x68,
					 0x46, 0x25, 0x2a, 0xbb, 0x34, 0x0b,
					 0xe4, 0x70, 0x87, 0xcc, 0x78, 0xf3,
					 0xd8, 0x7c };

	gnutls_datum_t ikmS_datum = { ikmS, sizeof(ikmS) };
	gnutls_datum_t psk_datum = { psk, sizeof(psk) };
	gnutls_datum_t psk_id_datum = { psk_id, sizeof(psk_id) };
	hpke_test_parameters_st params = {
		.mode = GNUTLS_HPKE_MODE_AUTH_PSK,
		.kem = GNUTLS_HPKE_KEM_DHKEM_X25519,
		.kdf = GNUTLS_HPKE_KDF_HKDF_SHA256,
		.aead = GNUTLS_HPKE_AEAD_EXPORT_ONLY,
		.ikmE = { ikmE, sizeof(ikmE) },
		.ikmR = { ikmR, sizeof(ikmR) },
		.ikmS = &ikmS_datum,
		.info = { info, sizeof(info) },
		.psk = &psk_datum,
		.psk_id = &psk_id_datum,
		.expected_enc = { expected_enc, sizeof(expected_enc) },
		.encryption_parameters = NULL,
		.num_encryption_parameters = 0,
		.exporter_parameters = exporter_params,
		.num_exporter_parameters =
			sizeof(exporter_params) / sizeof(exporter_params[0])
	};

	test_hpke(&params);
}

void doit(void)
{
	gnutls_global_init();

	rfc9180_a11();
	rfc9180_a12();
	rfc9180_a13();
	rfc9180_a14();

	rfc9180_a31();
	rfc9180_a32();
	rfc9180_a33();
	rfc9180_a34();

	rfc9180_a61();
	rfc9180_a62();
	rfc9180_a63();
	rfc9180_a64();

	rfc9180_a71();
	rfc9180_a72();
	rfc9180_a73();
	rfc9180_a74();

	if (!gnutls_fips140_mode_enabled()) {
		rfc9180_a21();
		rfc9180_a22();
		rfc9180_a23();
		rfc9180_a24();

		rfc9180_a51();
		rfc9180_a52();
		rfc9180_a53();
		rfc9180_a54();
	}

	gnutls_global_deinit();
}