/**
 * Response key derivation for EHBP
 *
 * This module implements the key derivation matching the Go implementation.
 *
 * The derivation follows OHTTP (RFC 9458):
 *   salt = concat(enc, response_nonce)
 *   prk = Extract(salt, secret)
 *   aead_key = Expand(prk, "key", Nk)
 *   aead_nonce = Expand(prk, "nonce", Nn)
 */
export declare const HPKE_REQUEST_INFO = "ehbp request";
export declare const EXPORT_LABEL = "ehbp response";
export declare const EXPORT_LENGTH = 32;
export declare const RESPONSE_NONCE_LENGTH = 32;
export declare const AES256_KEY_LENGTH = 32;
export declare const AES_GCM_NONCE_LENGTH = 12;
export declare const REQUEST_ENC_LENGTH = 32;
/**
 * Response key material for encryption/decryption
 */
export interface ResponseKeyMaterial {
    /** Raw key bytes for AEAD operations */
    keyBytes: Uint8Array;
    /** 12 bytes, XORed with sequence number for each chunk */
    nonceBase: Uint8Array;
}
/**
 * Derives response encryption keys from the HPKE exported secret.
 *
 *   salt = concat(enc, response_nonce)
 *   prk = Extract(salt, secret)
 *   key = Expand(prk, "key", 32)
 *   nonceBase = Expand(prk, "nonce", 12)
 *
 * @param exportedSecret - 32 bytes exported from HPKE context
 * @param requestEnc - 32 bytes encapsulated key from request
 * @param responseNonce - 32 bytes random nonce from response
 * @returns Key material for response encryption/decryption
 */
export declare function deriveResponseKeys(exportedSecret: Uint8Array, requestEnc: Uint8Array, responseNonce: Uint8Array): Promise<ResponseKeyMaterial>;
/**
 * Computes the nonce for a specific sequence number.
 * nonce = nonceBase XOR sequence_number (big-endian in last 8 bytes)
 */
export declare function computeNonce(nonceBase: Uint8Array, seq: number): Uint8Array;
/**
 * Encrypts a chunk using the response key material
 */
export declare function encryptChunk(km: ResponseKeyMaterial, seq: number, plaintext: Uint8Array): Promise<Uint8Array>;
/**
 * Decrypts a chunk using the response key material
 */
export declare function decryptChunk(km: ResponseKeyMaterial, seq: number, ciphertext: Uint8Array): Promise<Uint8Array>;
/**
 * Utility: Convert hex string to Uint8Array
 */
export declare function hexToBytes(hex: string): Uint8Array;
/**
 * Utility: Convert Uint8Array to hex string
 */
export declare function bytesToHex(bytes: Uint8Array): string;
//# sourceMappingURL=derive.d.ts.map