@@ -3,7 +3,7 @@
 [![Coverage Status](https://coveralls.io/repos//cloudflare/odoh-go/badge.svg?branch=master)](https://coveralls.io//cloudflare/odoh-go?branch=master)
 [![GoDoc](https://godoc.org/.com/cloudflare/odoh-go?status.svg)](https://godoc.org/.com/cloudflare/odoh-go)
 
-This library implements draft -03 of [Oblivious DoH](https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh-03). It is based on the original implementation [available here](https://.com/chris-wood/odoh).
+This library implements draft -04 of [Oblivious DoH](https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh-04). It is based on the original implementation [available here](https://.com/chris-wood/odoh).
 
 ![protocol overview](odoh-flow.png)
 

@@ -2,4 +2,4 @@ module .com/cloudflare/odoh-go
 
 go 1.14
 
-require .com/cisco/go-hpke v0.0.0-20201023221920-2866d2aa0603
+require .com/cisco/go-hpke v0.0.0-20201215202025-9cebdf8f33d4

@@ -28,11 +28,12 @@ import (
 "encoding/binary"
 "errors"
 "fmt"
+
 ".com/cisco/go-hpke"
 )
 
 const (
-ODOH_VERSION = uint16(0xff03)
+ODOH_VERSION = uint16(0xff04)
 ODOH_SECRET_LENGTH = 32
 ODOH_PADDING_BYTE = uint8(0)
 ODOH_LABEL_KEY_ID = "odoh key id"
@@ -58,7 +59,7 @@ func CreateObliviousDoHConfigContents(kemID hpke.KEMID, kdfID hpke.KDFID, aeadID
 return ObliviousDoHConfigContents{}, err
 }
 
-_, err = suite.KEM.Deserialize(publicKeyBytes)
+_, err = suite.KEM.DeserializePublicKey(publicKeyBytes)
 if err != nil {
 return ObliviousDoHConfigContents{}, err
 }
@@ -177,7 +178,7 @@ func UnmarshalObliviousDoHConfigContents(buffer []byte) (ObliviousDoHConfigConte
 return ObliviousDoHConfigContents{}, errors.New(fmt.Sprintf("Unsupported HPKE ciphersuite"))
 }
 
-_, err = suite.KEM.Deserialize(publicKeyBytes)
+_, err = suite.KEM.DeserializePublicKey(publicKeyBytes)
 if err != nil {
 return ObliviousDoHConfigContents{}, errors.New(fmt.Sprintf("Invalid HPKE public key bytes"))
 }
@@ -338,7 +339,7 @@ func CreateKeyPairFromSeed(kemID hpke.KEMID, kdfID hpke.KDFID, aeadID hpke.AEADI
 return ObliviousDoHKeyPair{}, err
 }
 
-configContents, err := CreateObliviousDoHConfigContents(kemID, kdfID, aeadID, suite.KEM.Serialize(pk))
+configContents, err := CreateObliviousDoHConfigContents(kemID, kdfID, aeadID, suite.KEM.SerializePublicKey(pk))
 if err != nil {
 return ObliviousDoHKeyPair{}, err
 }
@@ -369,7 +370,7 @@ func CreateKeyPair(kemID hpke.KEMID, kdfID hpke.KDFID, aeadID hpke.AEADID) (Obli
 return ObliviousDoHKeyPair{}, err
 }
 
-configContents, err := CreateObliviousDoHConfigContents(kemID, kdfID, aeadID, suite.KEM.Serialize(pk))
+configContents, err := CreateObliviousDoHConfigContents(kemID, kdfID, aeadID, suite.KEM.SerializePublicKey(pk))
 if err != nil {
 return ObliviousDoHKeyPair{}, err
 }
@@ -444,7 +445,7 @@ func (targetKey ObliviousDoHConfigContents) EncryptQuery(query *ObliviousDNSQuer
 return ObliviousDNSMessage{}, QueryContext{}, err
 }
 
-pkR, err := suite.KEM.Deserialize(targetKey.PublicKeyBytes)
+pkR, err := suite.KEM.DeserializePublicKey(targetKey.PublicKeyBytes)
 if err != nil {
 return ObliviousDNSMessage{}, QueryContext{}, err
 }

@@ -214,7 +214,7 @@ func createDefaultSerializedPublicKey(t *testing.T) []byte {
 t.Fatalf("Failed generating public key")
 }
 
-return suite.KEM.Serialize(publicKey)
+return suite.KEM.SerializePublicKey(publicKey)
 }
 
 func validateSerializedContents(t *testing.T, configContents ObliviousDoHConfigContents, serializedContents []byte) {
@@ -368,7 +368,7 @@ func TestQueryEncryption(t *testing.T) {
 KemID: kemID,
 KdfID: kdfID,
 AeadID: aeadID,
-PublicKeyBytes: suite.KEM.Serialize(pkR),
+PublicKeyBytes: suite.KEM.SerializePublicKey(pkR),
 }
 
 targetConfig := ObliviousDoHConfig{
@@ -423,7 +423,7 @@ func Test_Sender_ODOHQueryEncryption(t *testing.T) {
 KemID: kemID,
 KdfID: kdfID,
 AeadID: aeadID,
-PublicKeyBytes: suite.KEM.Serialize(pkR),
+PublicKeyBytes: suite.KEM.SerializePublicKey(pkR),
 }
 
 targetConfig := ObliviousDoHConfig{
@@ -486,7 +486,7 @@ func TestOdohPublicKeyMarshalUnmarshal(t *testing.T) {
 KemID: kemID,
 KdfID: kdfID,
 AeadID: aeadID,
-PublicKeyBytes: suite.KEM.Serialize(pkR),
+PublicKeyBytes: suite.KEM.SerializePublicKey(pkR),
 }
 
 serializedPublicKey := targetKey.Marshal()
@@ -611,15 +611,15 @@ func mustHex(d []byte) string {
 
 func mustDeserializePub(t *testing.T, suite hpke.CipherSuite, h string, required bool) hpke.KEMPublicKey {
 pkm := mustUnhex(t, h)
-pk, err := suite.KEM.Deserialize(pkm)
+pk, err := suite.KEM.DeserializePublicKey(pkm)
 if required {
 fatalOnError(t, err, "Deserialize failed")
 }
 return pk
 }
 
 func mustSerializePub(suite hpke.CipherSuite, pub hpke.KEMPublicKey) string {
-return mustHex(suite.KEM.Serialize(pub))
+return mustHex(suite.KEM.SerializePublicKey(pub))
 }
 
 ///////