MediumSealing Traffic Between Co-operating Go Services with crypto/hpke | by Cheikh seck | Jul, 2026 | Towards DevSitemapOpen in appSign up<br>Sign in

Medium Logo

Get app<br>Write

Search

Sign up<br>Sign in

Towards Dev

A publication for sharing projects, ideas, codes, and new theories.

Member-only story

Sealing Traffic Between Co-operating Go Services with crypto/hpke

A builder’s field guide to Hybrid Public Key Encryption in Go 1.26 — no PhD required

Cheikh seck

8 min read·<br>Just now

Listen

Share

Every time I wire two internal services together, I hit the same wall. Service A needs to send Service B something confidential. My options have always been:<br>A shared API token — a long-term secret sitting in two places, doubling the chance it leaks.<br>Mutual TLS — certificates, a CA, rotation, the whole ops tax.<br>Both work. Both are heavier than the problem deserves. What I actually want is simple: A sends B a message only B can open, and B can trust it came through the right channel — without either side holding a shared secret.<br>Go 1.26 recently promoted HPKE to a first-class standard-library package: crypto/hpke. It implements Hybrid Public Key Encryption (RFC 9180). I spent a weekend with it, and the craft of it is beautiful. Let me document it the way I wish someone had shown me — from zero, with the math explained like you remember linear algebra, and a runnable demo at the end.<br>(This article was co-authored with https://liteagent.cloud/ . Try it today!)<br>Press enter or click to view image in full size

Start from zero: what is encryption, really?

Published in Towards Dev<br>10.4K followers<br>·Last published just now

A publication for sharing projects, ideas, codes, and new theories.

Written by Cheikh seck<br>315 followers<br>·19 following

Get your personal AI intern: https://liteagent.cloud/ -- Practice your English with https://www.convose.com/

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech