Fix cc/experimental/pqcrypto folder structure.

Current cc/experimental/pqcrypto folder structure is inconsistent. Signature
schemes have a single folder (pqcrypto/signatures) while the existing KEM
(CECPQ2) was organized in a per-scheme folder structure. The signature approach
is easier to maintain, to scale and minimizes the visibility changes to non
experimental targets. In addition, we are merging the old CECPQ2 'internal' and
'subtle' folders into a single 'subtle' folder.

This CL does not contain any other change other than moving files and fixing
the corresponding paths for includes and building files.

PiperOrigin-RevId: 447526949

38 files changed, 315 insertions, 328 deletions

diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/BUILD.bazel b/cc/experimental/pqcrypto/cecpq2/hybrid/internal/BUILD.bazel
deleted file mode 100644
index 245939ff7..000000000
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/BUILD.bazel
+++ /dev/null
@@ -1,108 +0,0 @@
-# package containing hybrid encryption internal implementations of PQC primitives
-
-package(default_visibility = ["//:__subpackages__"])
-
-licenses(["notice"])
-
-cc_library(
-    name = "cecpq2_aead_hkdf_hybrid_decrypt",
-    srcs = ["cecpq2_aead_hkdf_hybrid_decrypt.cc"],
-    hdrs = ["cecpq2_aead_hkdf_hybrid_decrypt.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid/internal",
-    deps = [
-        "//:hybrid_decrypt",
-        "//experimental/pqcrypto/cecpq2/hybrid:cecpq2_aead_hkdf_dem_helper",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_hkdf_recipient_kem_boringssl",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_subtle_boringssl_util",
-        "//internal:ec_util",
-        "//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
-        "//util:enums",
-        "//util:secret_data",
-        "//util:status",
-        "//util:statusor",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-    ],
-)
-
-cc_library(
-    name = "cecpq2_aead_hkdf_hybrid_encrypt",
-    srcs = ["cecpq2_aead_hkdf_hybrid_encrypt.cc"],
-    hdrs = ["cecpq2_aead_hkdf_hybrid_encrypt.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid/internal",
-    deps = [
-        "//:aead",
-        "//:hybrid_encrypt",
-        "//experimental/pqcrypto/cecpq2/hybrid:cecpq2_aead_hkdf_dem_helper",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_hkdf_sender_kem_boringssl",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_subtle_boringssl_util",
-        "//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
-        "//util:enums",
-        "//util:status",
-        "//util:statusor",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/strings",
-    ],
-)
-
-# tests
-
-cc_test(
-    name = "cecpq2_aead_hkdf_hybrid_encrypt_test",
-    size = "small",
-    srcs = ["cecpq2_aead_hkdf_hybrid_encrypt_test.cc"],
-    deps = [
-        ":cecpq2_aead_hkdf_hybrid_encrypt",
-        "//:hybrid_encrypt",
-        "//:registry",
-        "//aead:aes_gcm_key_manager",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_subtle_boringssl_util",
-        "//experimental/pqcrypto/cecpq2/util:test_util",
-        "//subtle:random",
-        "//subtle:subtle_util",
-        "//util:enums",
-        "//util:statusor",
-        "//util:test_matchers",
-        "//util:test_util",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-        "@com_google_googletest//:gtest_main",
-    ],
-)
-
-cc_test(
-    name = "cecpq2_aead_hkdf_hybrid_decrypt_test",
-    size = "large",
-    srcs = ["cecpq2_aead_hkdf_hybrid_decrypt_test.cc"],
-    deps = [
-        ":cecpq2_aead_hkdf_hybrid_decrypt",
-        ":cecpq2_aead_hkdf_hybrid_encrypt",
-        "//:hybrid_decrypt",
-        "//:registry",
-        "//aead:aes_ctr_hmac_aead_key_manager",
-        "//aead:aes_gcm_key_manager",
-        "//aead:xchacha20_poly1305_key_manager",
-        "//config:tink_config",
-        "//daead:aes_siv_key_manager",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_subtle_boringssl_util",
-        "//experimental/pqcrypto/cecpq2/util:test_util",
-        "//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
-        "//subtle:common_enums",
-        "//subtle:random",
-        "//subtle:subtle_util",
-        "//util:enums",
-        "//util:secret_data",
-        "//util:status",
-        "//util:statusor",
-        "//util:test_matchers",
-        "//util:test_util",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/strings",
-        "@com_google_googletest//:gtest_main",
-    ],
-)
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/BUILD.bazel b/cc/experimental/pqcrypto/cecpq2/subtle/BUILD.bazel
deleted file mode 100644
index 7b7e86860..000000000
--- a/cc/experimental/pqcrypto/cecpq2/subtle/BUILD.bazel
+++ /dev/null
@@ -1,121 +0,0 @@
-# package containing subtle implementations of PQC primitives
-
-package(default_visibility = ["//:__subpackages__"])
-
-licenses(["notice"])
-
-cc_library(
-    name = "cecpq2_hkdf_sender_kem_boringssl",
-    srcs = ["cecpq2_hkdf_sender_kem_boringssl.cc"],
-    hdrs = ["cecpq2_hkdf_sender_kem_boringssl.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/subtle",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//internal:fips_utils",
-        "//subtle",
-        "//subtle:common_enums",
-        "//subtle:hkdf",
-        "//subtle:random",
-        "//subtle:subtle_util",
-        "//util:secret_data",
-        "//util:statusor",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/strings",
-    ],
-)
-
-cc_library(
-    name = "cecpq2_hkdf_recipient_kem_boringssl",
-    srcs = ["cecpq2_hkdf_recipient_kem_boringssl.cc"],
-    hdrs = ["cecpq2_hkdf_recipient_kem_boringssl.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/subtle",
-    visibility = ["//visibility:public"],
-    deps = [
-        ":cecpq2_hkdf_sender_kem_boringssl",
-        "//internal:fips_utils",
-        "//subtle",
-        "//subtle:common_enums",
-        "//subtle:hkdf",
-        "//util:errors",
-        "//util:secret_data",
-        "//util:statusor",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-        "@com_google_absl//absl/strings",
-    ],
-)
-
-cc_library(
-    name = "cecpq2_subtle_boringssl_util",
-    srcs = ["cecpq2_subtle_boringssl_util.cc"],
-    hdrs = ["cecpq2_subtle_boringssl_util.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/subtle",
-    visibility = ["//visibility:public"],
-    deps = [
-        "//subtle",
-        "//subtle:subtle_util",
-        "//util:secret_data",
-        "//util:statusor",
-        "@boringssl//:crypto",
-    ],
-)
-
-#tests
-
-cc_test(
-    name = "cecpq2_hkdf_sender_kem_boringssl_test",
-    srcs = ["cecpq2_hkdf_sender_kem_boringssl_test.cc"],
-    deps = [
-        ":cecpq2_hkdf_recipient_kem_boringssl",
-        ":cecpq2_hkdf_sender_kem_boringssl",
-        ":cecpq2_subtle_boringssl_util",
-        "//config:tink_fips",
-        "//subtle",
-        "//subtle:common_enums",
-        "//subtle:hkdf",
-        "//subtle:random",
-        "//subtle:subtle_util",
-        "//util:secret_data",
-        "//util:status",
-        "//util:statusor",
-        "//util:test_matchers",
-        "//util:test_util",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/memory",
-        "@com_google_absl//absl/status",
-        "@com_google_googletest//:gtest_main",
-    ],
-)
-
-cc_test(
-    name = "cecpq2_hkdf_recipient_kem_boringssl_test",
-    srcs = ["cecpq2_hkdf_recipient_kem_boringssl_test.cc"],
-    deps = [
-        ":cecpq2_hkdf_recipient_kem_boringssl",
-        "//config:tink_fips",
-        "//subtle:random",
-        "//util:test_matchers",
-        "//util:test_util",
-        "@boringssl//:crypto",
-        "@com_google_absl//absl/status",
-        "@com_google_googletest//:gtest_main",
-    ],
-)
-
-cc_test(
-    name = "cecpq2_subtle_boringssl_util_test",
-    srcs = ["cecpq2_subtle_boringssl_util_test.cc"],
-    deps = [
-        ":cecpq2_subtle_boringssl_util",
-        "//subtle:random",
-        "//subtle:subtle_util",
-        "//util:secret_data",
-        "//util:test_matchers",
-        "//util:test_util",
-        "@boringssl//:crypto",
-        "@com_google_googletest//:gtest_main",
-    ],
-)
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/BUILD.bazel b/cc/experimental/pqcrypto/kem/BUILD.bazel
index d7444b500..a9c600a8e 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/BUILD.bazel
+++ b/cc/experimental/pqcrypto/kem/BUILD.bazel
@@ -8,7 +8,7 @@ cc_library(
     name = "cecpq2_hybrid_config",
     srcs = ["cecpq2_hybrid_config.cc"],
     hdrs = ["cecpq2_hybrid_config.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid",
+    include_prefix = "tink/experimental/pqcrypto/kem/",
     deps = [
         ":cecpq2_aead_hkdf_private_key_manager",
         ":cecpq2_aead_hkdf_public_key_manager",
@@ -27,7 +27,7 @@ cc_library(
     name = "cecpq2_hybrid_key_templates",
     srcs = ["cecpq2_hybrid_key_templates.cc"],
     hdrs = ["cecpq2_hybrid_key_templates.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid",
+    include_prefix = "tink/experimental/pqcrypto/kem/",
     deps = [
         "//aead:aead_key_templates",
         "//daead:deterministic_aead_key_templates",
@@ -42,7 +42,7 @@ cc_library(
     name = "cecpq2_aead_hkdf_dem_helper",
     srcs = ["cecpq2_aead_hkdf_dem_helper.cc"],
     hdrs = ["cecpq2_aead_hkdf_dem_helper.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid",
+    include_prefix = "tink/experimental/pqcrypto/kem/",
     deps = [
         "//:aead",
         "//:deterministic_aead",
@@ -63,15 +63,15 @@ cc_library(
     name = "cecpq2_aead_hkdf_private_key_manager",
     srcs = ["cecpq2_aead_hkdf_private_key_manager.cc"],
     hdrs = ["cecpq2_aead_hkdf_private_key_manager.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid",
+    include_prefix = "tink/experimental/pqcrypto/kem/",
     deps = [
         ":cecpq2_aead_hkdf_dem_helper",
         ":cecpq2_aead_hkdf_public_key_manager",
         "//:core/key_type_manager",
         "//:core/private_key_type_manager",
         "//:hybrid_decrypt",
-        "//experimental/pqcrypto/cecpq2/hybrid/internal:cecpq2_aead_hkdf_hybrid_decrypt",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_subtle_boringssl_util",
+        "//experimental/pqcrypto/kem/subtle:cecpq2_aead_hkdf_hybrid_decrypt",
+        "//experimental/pqcrypto/kem/subtle:cecpq2_subtle_boringssl_util",
         "//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
         "//proto:tink_cc_proto",
         "//subtle:random",
@@ -92,12 +92,12 @@ cc_library(
     name = "cecpq2_aead_hkdf_public_key_manager",
     srcs = ["cecpq2_aead_hkdf_public_key_manager.cc"],
     hdrs = ["cecpq2_aead_hkdf_public_key_manager.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/hybrid",
+    include_prefix = "tink/experimental/pqcrypto/kem/",
     deps = [
         ":cecpq2_aead_hkdf_dem_helper",
         "//:core/key_type_manager",
         "//:hybrid_encrypt",
-        "//experimental/pqcrypto/cecpq2/hybrid/internal:cecpq2_aead_hkdf_hybrid_encrypt",
+        "//experimental/pqcrypto/kem/subtle:cecpq2_aead_hkdf_hybrid_encrypt",
         "//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
         "//proto:common_cc_proto",
         "//proto:tink_cc_proto",
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.cc b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.cc
index 571d8b15b..badab1de9 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
 
 #include <string>
 #include <utility>
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h
index 5d2e2b6c0..202df3937 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_DEM_HELPER_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_DEM_HELPER_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_DEM_HELPER_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_DEM_HELPER_H_
 
 #include <memory>
 
@@ -52,4 +52,4 @@ class Cecpq2AeadHkdfDemHelper {
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_DEM_HELPER_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_DEM_HELPER_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper_test.cc b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper_test.cc
index 1b54f2fa9..8119e8d56 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper_test.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper_test.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
 
 #include <string>
 #include <utility>
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.cc b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.cc
index 8e1cc68a3..6b6854d5e 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h"
 
 #include <string>
 #include <utility>
@@ -23,9 +23,9 @@
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 #include "openssl/hrss.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/subtle/random.h"
 #include "tink/subtle/subtle_util.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h
index 5f1d62d4e..46b8a0a38 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h
@@ -13,8 +13,8 @@
 // limitations under the License.
 //
 ///////////////////////////////////////////////////////////////////////////////
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_PRIVATE_KEY_MANAGER_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_PRIVATE_KEY_MANAGER_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_PRIVATE_KEY_MANAGER_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_PRIVATE_KEY_MANAGER_H_
 
 #include <memory>
 #include <string>
@@ -24,8 +24,8 @@
 #include "openssl/hrss.h"
 #include "tink/core/key_type_manager.h"
 #include "tink/core/private_key_type_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/util/enums.h"
 #include "tink/util/status.h"
@@ -86,4 +86,4 @@ class Cecpq2AeadHkdfPrivateKeyManager
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_PRIVATE_KEY_MANAGER_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_PRIVATE_KEY_MANAGER_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager_test.cc b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager_test.cc
index 53e6c25af..1ed0b6085 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager_test.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager_test.cc
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h"
 
 #include <string>
 
@@ -23,7 +23,7 @@
 #include "tink/aead/aead_key_templates.h"
 #include "tink/aead/aes_ctr_hmac_aead_key_manager.h"
 #include "tink/aead/aes_gcm_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/registry.h"
 #include "tink/util/status.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.cc b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.cc
index 417ca44db..e928d5797 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.cc
@@ -14,11 +14,11 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h"
 
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h"
 #include "tink/hybrid_encrypt.h"
 #include "tink/util/errors.h"
 #include "tink/util/protobuf_helper.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h
index 35a7591ae..0e212af44 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h
@@ -13,8 +13,8 @@
 // limitations under the License.
 //
 ///////////////////////////////////////////////////////////////////////////////
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_PUBLIC_KEY_MANAGER_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_PUBLIC_KEY_MANAGER_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_PUBLIC_KEY_MANAGER_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_PUBLIC_KEY_MANAGER_H_
 
 #include <memory>
 #include <string>
@@ -22,8 +22,8 @@
 #include "absl/memory/memory.h"
 #include "absl/strings/str_cat.h"
 #include "tink/core/key_type_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h"
 #include "tink/hybrid_encrypt.h"
 #include "tink/util/enums.h"
 #include "tink/util/errors.h"
@@ -75,4 +75,4 @@ class Cecpq2AeadHkdfPublicKeyManager
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_AEAD_HKDF_PUBLIC_KEY_MANAGER_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_AEAD_HKDF_PUBLIC_KEY_MANAGER_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager_test.cc b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager_test.cc
index 8f47d8212..5f73c0abf 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager_test.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager_test.cc
@@ -14,13 +14,13 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h"
 
 #include "gtest/gtest.h"
 #include "absl/status/status.h"
 #include "tink/aead/aead_key_templates.h"
 #include "tink/aead/aes_gcm_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h"
 #include "tink/hybrid_encrypt.h"
 #include "tink/registry.h"
 #include "tink/util/status.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.cc b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_config.cc
index 89e596341..e34a70c1c 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_config.cc
@@ -14,13 +14,13 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_hybrid_config.h"
 
 #include "absl/memory/memory.h"
 #include "tink/aead/aead_config.h"
 #include "tink/config/tink_fips.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h"
 #include "tink/hybrid/hybrid_decrypt_wrapper.h"
 #include "tink/hybrid/hybrid_encrypt_wrapper.h"
 #include "tink/registry.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.h b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_config.h
index e71ebab06..9a7c558d8 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.h
+++ b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_config.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_HYBRID_CONFIG_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_HYBRID_CONFIG_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_HYBRID_CONFIG_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_HYBRID_CONFIG_H_
 
 #include "absl/base/macros.h"
 #include "tink/util/status.h"
@@ -41,4 +41,4 @@ crypto::tink::util::Status Cecpq2HybridConfigRegister();
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_HYBRID_CONFIG_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_HYBRID_CONFIG_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config_test.cc b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_config_test.cc
index 539f86010..d8680e254 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config_test.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_config_test.cc
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_hybrid_config.h"
 
 #include <list>
 #include <string>
@@ -24,9 +24,9 @@
 #include "gtest/gtest.h"
 #include "absl/status/status.h"
 #include "tink/config/tink_fips.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_public_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_public_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/hybrid_encrypt.h"
 #include "tink/keyset_handle.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.cc b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.cc
index 6ac9ae9cc..c51a426c2 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.h"
 
 #include <string>
 
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.h b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.h
index e8b08f636..7454e9e82 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.h
+++ b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_HYBRID_KEY_TEMPLATES_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_HYBRID_KEY_TEMPLATES_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_HYBRID_KEY_TEMPLATES_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_HYBRID_KEY_TEMPLATES_H_
 
 #include "proto/tink.pb.h"
 
@@ -70,4 +70,4 @@ Cecpq2HybridKeyTemplateX25519HkdfHmacSha256DeterministicAesSiv();
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_CECPQ2_HYBRID_KEY_TEMPLATES_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_CECPQ2_HYBRID_KEY_TEMPLATES_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates_test.cc b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates_test.cc
index 264c2bcd4..186003bbb 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates_test.cc
+++ b/cc/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates_test.cc
@@ -14,12 +14,12 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_key_templates.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_hybrid_key_templates.h"
 
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_private_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_hybrid_config.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_private_key_manager.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_hybrid_config.h"
 #include "tink/util/test_matchers.h"
 #include "proto/experimental/pqcrypto/cecpq2_aead_hkdf.pb.h"
 
diff --git a/cc/experimental/pqcrypto/kem/subtle/BUILD.bazel b/cc/experimental/pqcrypto/kem/subtle/BUILD.bazel
new file mode 100644
index 000000000..476ed42b4
--- /dev/null
+++ b/cc/experimental/pqcrypto/kem/subtle/BUILD.bazel
@@ -0,0 +1,216 @@
+# package containing subtle implementations of PQC primitives
+
+package(default_visibility = ["//:__subpackages__"])
+
+licenses(["notice"])
+
+cc_library(
+    name = "cecpq2_hkdf_sender_kem_boringssl",
+    srcs = ["cecpq2_hkdf_sender_kem_boringssl.cc"],
+    hdrs = ["cecpq2_hkdf_sender_kem_boringssl.h"],
+    include_prefix = "tink/experimental/pqcrypto/kem/subtle",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//internal:fips_utils",
+        "//subtle",
+        "//subtle:common_enums",
+        "//subtle:hkdf",
+        "//subtle:random",
+        "//subtle:subtle_util",
+        "//util:secret_data",
+        "//util:statusor",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/memory",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_library(
+    name = "cecpq2_hkdf_recipient_kem_boringssl",
+    srcs = ["cecpq2_hkdf_recipient_kem_boringssl.cc"],
+    hdrs = ["cecpq2_hkdf_recipient_kem_boringssl.h"],
+    include_prefix = "tink/experimental/pqcrypto/kem/subtle",
+    visibility = ["//visibility:public"],
+    deps = [
+        ":cecpq2_hkdf_sender_kem_boringssl",
+        "//internal:fips_utils",
+        "//subtle",
+        "//subtle:common_enums",
+        "//subtle:hkdf",
+        "//util:errors",
+        "//util:secret_data",
+        "//util:statusor",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/memory",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+    ],
+)
+
+cc_library(
+    name = "cecpq2_subtle_boringssl_util",
+    srcs = ["cecpq2_subtle_boringssl_util.cc"],
+    hdrs = ["cecpq2_subtle_boringssl_util.h"],
+    include_prefix = "tink/experimental/pqcrypto/kem/subtle",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//subtle",
+        "//subtle:subtle_util",
+        "//util:secret_data",
+        "//util:statusor",
+        "@boringssl//:crypto",
+    ],
+)
+
+cc_library(
+    name = "cecpq2_aead_hkdf_hybrid_decrypt",
+    srcs = ["cecpq2_aead_hkdf_hybrid_decrypt.cc"],
+    hdrs = ["cecpq2_aead_hkdf_hybrid_decrypt.h"],
+    include_prefix = "tink/experimental/pqcrypto/kem/subtle",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+        "@tink_cc//:hybrid_decrypt",
+        "@tink_cc//experimental/pqcrypto/kem:cecpq2_aead_hkdf_dem_helper",
+        "@tink_cc//experimental/pqcrypto/kem/subtle:cecpq2_hkdf_recipient_kem_boringssl",
+        "@tink_cc//experimental/pqcrypto/kem/subtle:cecpq2_subtle_boringssl_util",
+        "@tink_cc//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
+        "@tink_cc//subtle:ec_util",
+        "@tink_cc//util:enums",
+        "@tink_cc//util:secret_data",
+        "@tink_cc//util:status",
+        "@tink_cc//util:statusor",
+    ],
+)
+
+cc_library(
+    name = "cecpq2_aead_hkdf_hybrid_encrypt",
+    srcs = ["cecpq2_aead_hkdf_hybrid_encrypt.cc"],
+    hdrs = ["cecpq2_aead_hkdf_hybrid_encrypt.h"],
+    include_prefix = "tink/experimental/pqcrypto/kem/subtle",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@com_google_absl//absl/status",
+        "@com_google_absl//absl/strings",
+        "@tink_cc//:aead",
+        "@tink_cc//:hybrid_encrypt",
+        "@tink_cc//experimental/pqcrypto/kem:cecpq2_aead_hkdf_dem_helper",
+        "@tink_cc//experimental/pqcrypto/kem/subtle:cecpq2_hkdf_sender_kem_boringssl",
+        "@tink_cc//experimental/pqcrypto/kem/subtle:cecpq2_subtle_boringssl_util",
+        "@tink_cc//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
+        "@tink_cc//util:enums",
+        "@tink_cc//util:status",
+        "@tink_cc//util:statusor",
+    ],
+)
+
+#tests
+
+cc_test(
+    name = "cecpq2_hkdf_sender_kem_boringssl_test",
+    srcs = ["cecpq2_hkdf_sender_kem_boringssl_test.cc"],
+    deps = [
+        ":cecpq2_hkdf_recipient_kem_boringssl",
+        ":cecpq2_hkdf_sender_kem_boringssl",
+        ":cecpq2_subtle_boringssl_util",
+        "//config:tink_fips",
+        "//subtle",
+        "//subtle:common_enums",
+        "//subtle:hkdf",
+        "//subtle:random",
+        "//subtle:subtle_util",
+        "//util:secret_data",
+        "//util:status",
+        "//util:statusor",
+        "//util:test_matchers",
+        "//util:test_util",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/memory",
+        "@com_google_absl//absl/status",
+        "@com_google_googletest//:gtest_main",
+    ],
+)
+
+cc_test(
+    name = "cecpq2_hkdf_recipient_kem_boringssl_test",
+    srcs = ["cecpq2_hkdf_recipient_kem_boringssl_test.cc"],
+    deps = [
+        ":cecpq2_hkdf_recipient_kem_boringssl",
+        "//config:tink_fips",
+        "//subtle:random",
+        "//util:test_matchers",
+        "//util:test_util",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/status",
+        "@com_google_googletest//:gtest_main",
+    ],
+)
+
+cc_test(
+    name = "cecpq2_subtle_boringssl_util_test",
+    srcs = ["cecpq2_subtle_boringssl_util_test.cc"],
+    deps = [
+        ":cecpq2_subtle_boringssl_util",
+        "//subtle:random",
+        "//subtle:subtle_util",
+        "//util:secret_data",
+        "//util:test_matchers",
+        "//util:test_util",
+        "@boringssl//:crypto",
+        "@com_google_googletest//:gtest_main",
+    ],
+)
+
+cc_test(
+    name = "cecpq2_aead_hkdf_hybrid_encrypt_test",
+    size = "small",
+    srcs = ["cecpq2_aead_hkdf_hybrid_encrypt_test.cc"],
+    copts = ["-Iexternal/gtest/include"],
+    deps = [
+        ":cecpq2_aead_hkdf_hybrid_encrypt",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/status",
+        "@com_google_googletest//:gtest_main",
+        "@tink_cc//:hybrid_encrypt",
+        "@tink_cc//aead:aes_gcm_key_manager",
+        "@tink_cc//experimental/pqcrypto/kem/subtle:cecpq2_subtle_boringssl_util",
+        "@tink_cc//experimental/pqcrypto/kem/util:test_util",
+        "@tink_cc//subtle:random",
+        "@tink_cc//subtle:subtle_util",
+        "@tink_cc//util:enums",
+        "@tink_cc//util:statusor",
+        "@tink_cc//util:test_matchers",
+        "@tink_cc//util:test_util",
+    ],
+)
+
+cc_test(
+    name = "cecpq2_aead_hkdf_hybrid_decrypt_test",
+    size = "small",
+    srcs = ["cecpq2_aead_hkdf_hybrid_decrypt_test.cc"],
+    copts = ["-Iexternal/gtest/include"],
+    deps = [
+        ":cecpq2_aead_hkdf_hybrid_decrypt",
+        ":cecpq2_aead_hkdf_hybrid_encrypt",
+        "@boringssl//:crypto",
+        "@com_google_absl//absl/status",
+        "@com_google_googletest//:gtest_main",
+        "@tink_cc//:hybrid_encrypt",
+        "@tink_cc//aead:aes_ctr_hmac_aead_key_manager",
+        "@tink_cc//aead:aes_gcm_key_manager",
+        "@tink_cc//aead:xchacha20_poly1305_key_manager",
+        "@tink_cc//config:tink_config",
+        "@tink_cc//experimental/pqcrypto/kem/subtle:cecpq2_subtle_boringssl_util",
+        "@tink_cc//experimental/pqcrypto/kem/util:test_util",
+        "@tink_cc//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
+        "@tink_cc//subtle:random",
+        "@tink_cc//subtle:subtle_util",
+        "@tink_cc//util:enums",
+        "@tink_cc//util:statusor",
+        "@tink_cc//util:test_matchers",
+        "@tink_cc//util:test_util",
+    ],
+)
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.cc
index 96b8b2799..933eb4a00 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.h"
 
 #include <string>
 #include <utility>
@@ -23,8 +23,8 @@
 #include "absl/status/status.h"
 #include "openssl/hrss.h"
 #include "openssl/nid.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/internal/ec_util.h"
 #include "tink/util/enums.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.h b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.h
index 56dd92760..c0ac3774d 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.h
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.h
@@ -14,16 +14,16 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_INTERNAL_CECPQ2_AEAD_HKDF_HYBRID_DECRYPT_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_INTERNAL_CECPQ2_AEAD_HKDF_HYBRID_DECRYPT_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_AEAD_HKDF_HYBRID_DECRYPT_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_AEAD_HKDF_HYBRID_DECRYPT_H_
 
 #include <memory>
 #include <string>
 #include <utility>
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/util/statusor.h"
 #include "proto/experimental/pqcrypto/cecpq2_aead_hkdf.pb.h"
@@ -61,4 +61,4 @@ class Cecpq2AeadHkdfHybridDecrypt : public HybridDecrypt {
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_INTERNAL_CECPQ2_AEAD_HKDF_HYBRID_DECRYPT_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_AEAD_HKDF_HYBRID_DECRYPT_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt_test.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt_test.cc
index 8b6f34ef5..8c48ad13a 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt_test.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt_test.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_decrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_decrypt.h"
 
 #include <string>
 #include <utility>
@@ -31,9 +31,9 @@
 #include "tink/aead/xchacha20_poly1305_key_manager.h"
 #include "tink/config/tink_config.h"
 #include "tink/daead/aes_siv_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
-#include "tink/experimental/pqcrypto/cecpq2/util/test_util.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/util/test_util.h"
 #include "tink/hybrid_decrypt.h"
 #include "tink/registry.h"
 #include "tink/subtle/common_enums.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.cc
index 9bd2fdc48..eb0c665a1 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h"
 
 #include <string>
 #include <utility>
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h
index 47a67af27..5bed5aa43 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h
@@ -14,16 +14,16 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_INTERNAL_CECPQ2_AEAD_HKDF_HYBRID_ENCRYPT_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_INTERNAL_CECPQ2_AEAD_HKDF_HYBRID_ENCRYPT_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_AEAD_HKDF_HYBRID_ENCRYPT_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_AEAD_HKDF_HYBRID_ENCRYPT_H_
 
 #include <memory>
 #include <string>
 #include <utility>
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/cecpq2_aead_hkdf_dem_helper.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/cecpq2_aead_hkdf_dem_helper.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 #include "tink/hybrid_encrypt.h"
 #include "tink/util/statusor.h"
 #include "proto/experimental/pqcrypto/cecpq2_aead_hkdf.pb.h"
@@ -61,4 +61,4 @@ class Cecpq2AeadHkdfHybridEncrypt : public HybridEncrypt {
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_HYBRID_INTERNAL_CECPQ2_AEAD_HKDF_HYBRID_ENCRYPT_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_AEAD_HKDF_HYBRID_ENCRYPT_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt_test.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt_test.cc
index d810f7adb..7d5a34786 100644
--- a/cc/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt_test.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt_test.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/hybrid/internal/cecpq2_aead_hkdf_hybrid_encrypt.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_aead_hkdf_hybrid_encrypt.h"
 
 #include <string>
 #include <utility>
@@ -25,8 +25,8 @@
 #include "openssl/curve25519.h"
 #include "openssl/hrss.h"
 #include "tink/aead/aes_gcm_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
-#include "tink/experimental/pqcrypto/cecpq2/util/test_util.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/util/test_util.h"
 #include "tink/hybrid_encrypt.h"
 #include "tink/registry.h"
 #include "tink/subtle/random.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.cc
index 092de2df0..f8e7baa5c 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
 
 #include <utility>
 
@@ -25,7 +25,7 @@
 #include "openssl/curve25519.h"
 #include "openssl/ec.h"
 #include "openssl/hrss.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
 #include "tink/subtle/common_enums.h"
 #include "tink/subtle/hkdf.h"
 #include "tink/util/errors.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h
index 60f553399..fca6b659d 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_HKDF_RECIPIENT_KEM_BORINGSSL_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_HKDF_RECIPIENT_KEM_BORINGSSL_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_HKDF_RECIPIENT_KEM_BORINGSSL_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_HKDF_RECIPIENT_KEM_BORINGSSL_H_
 
 #include <memory>
 #include <utility>
@@ -126,4 +126,4 @@ class Cecpq2HkdfX25519RecipientKemBoringSsl
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_HKDF_RECIPIENT_KEM_BORINGSSL_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_HKDF_RECIPIENT_KEM_BORINGSSL_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl_test.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl_test.cc
index 5680b5814..f2ead223e 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl_test.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl_test.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
 
 #include <string>
 #include <utility>
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.cc
index a3f5ef642..a67c8b5a3 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
 
 #include <string>
 #include <utility>
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.h b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.h
index 36ec3d9c2..e24e8b8a4 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.h
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_HKDF_SENDER_KEM_BORINGSSL_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_HKDF_SENDER_KEM_BORINGSSL_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_HKDF_SENDER_KEM_BORINGSSL_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_HKDF_SENDER_KEM_BORINGSSL_H_
 
 #include <memory>
 #include <string>
@@ -157,4 +157,4 @@ class Cecpq2HkdfX25519SenderKemBoringSsl : public Cecpq2HkdfSenderKemBoringSsl {
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_HKDF_SENDER_KEM_BORINGSSL_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_HKDF_SENDER_KEM_BORINGSSL_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl_test.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl_test.cc
index 03b569b49..ce18b2ecd 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl_test.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl_test.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_sender_kem_boringssl.h"
 
 #include <string>
 #include <utility>
@@ -26,8 +26,8 @@
 #include "openssl/hrss.h"
 #include "openssl/sha.h"
 #include "tink/config/tink_fips.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_hkdf_recipient_kem_boringssl.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 #include "tink/subtle/common_enums.h"
 #include "tink/subtle/hkdf.h"
 #include "tink/subtle/random.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.cc
index b30084153..cbf92c9a0 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 
 #include <utility>
 
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h b/cc/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h
index 11cac6064..54ac83166 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_SUBTLE_BORINGSSL_UTIL_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_SUBTLE_BORINGSSL_UTIL_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_SUBTLE_BORINGSSL_UTIL_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_SUBTLE_BORINGSSL_UTIL_H_
 
 #include <string>
 
@@ -59,4 +59,4 @@ GenerateCecpq2Keypair(subtle::EllipticCurveType curve_type);
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_SUBTLE_CECPQ2_SUBTLE_BORINGSSL_UTIL_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_SUBTLE_CECPQ2_SUBTLE_BORINGSSL_UTIL_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util_test.cc b/cc/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util_test.cc
index 05138375f..ea804d8bc 100644
--- a/cc/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util_test.cc
+++ b/cc/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util_test.cc
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 
 #include <string>
 
diff --git a/cc/experimental/pqcrypto/cecpq2/util/BUILD.bazel b/cc/experimental/pqcrypto/kem/util/BUILD.bazel
index 508b70f26..5fa1e95b1 100644
--- a/cc/experimental/pqcrypto/cecpq2/util/BUILD.bazel
+++ b/cc/experimental/pqcrypto/kem/util/BUILD.bazel
@@ -9,12 +9,12 @@ cc_library(
     testonly = 1,
     srcs = ["test_util.cc"],
     hdrs = ["test_util.h"],
-    include_prefix = "tink/experimental/pqcrypto/cecpq2/util",
+    include_prefix = "tink/experimental/pqcrypto/kem/util",
     deps = [
         "//aead:aes_ctr_hmac_aead_key_manager",
         "//aead:aes_gcm_key_manager",
         "//aead:xchacha20_poly1305_key_manager",
-        "//experimental/pqcrypto/cecpq2/subtle:cecpq2_subtle_boringssl_util",
+        "//experimental/pqcrypto/kem/subtle:cecpq2_subtle_boringssl_util",
         "//experimental/pqcrypto/proto:cecpq2_aead_hkdf_cc_proto",
         "//proto:aes_ctr_cc_proto",
         "//proto:aes_ctr_hmac_aead_cc_proto",
diff --git a/cc/experimental/pqcrypto/cecpq2/util/test_util.cc b/cc/experimental/pqcrypto/kem/util/test_util.cc
index d0df65fc1..ff4e43bbe 100644
--- a/cc/experimental/pqcrypto/cecpq2/util/test_util.cc
+++ b/cc/experimental/pqcrypto/kem/util/test_util.cc
@@ -14,7 +14,7 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/util/test_util.h"
+#include "tink/experimental/pqcrypto/kem/util/test_util.h"
 
 #include <string>
 #include <utility>
@@ -24,7 +24,7 @@
 #include "tink/aead/aes_ctr_hmac_aead_key_manager.h"
 #include "tink/aead/aes_gcm_key_manager.h"
 #include "tink/aead/xchacha20_poly1305_key_manager.h"
-#include "tink/experimental/pqcrypto/cecpq2/subtle/cecpq2_subtle_boringssl_util.h"
+#include "tink/experimental/pqcrypto/kem/subtle/cecpq2_subtle_boringssl_util.h"
 #include "tink/subtle/subtle_util.h"
 #include "tink/util/enums.h"
 #include "proto/aes_ctr.pb.h"
diff --git a/cc/experimental/pqcrypto/cecpq2/util/test_util.h b/cc/experimental/pqcrypto/kem/util/test_util.h
index 8f82fc854..dc970189c 100644
--- a/cc/experimental/pqcrypto/cecpq2/util/test_util.h
+++ b/cc/experimental/pqcrypto/kem/util/test_util.h
@@ -14,8 +14,8 @@
 //
 ///////////////////////////////////////////////////////////////////////////////
 
-#ifndef TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_UTIL_TEST_UTIL_H_
-#define TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_UTIL_TEST_UTIL_H_
+#ifndef TINK_EXPERIMENTAL_PQCRYPTO_KEM_UTIL_TEST_UTIL_H_
+#define TINK_EXPERIMENTAL_PQCRYPTO_KEM_UTIL_TEST_UTIL_H_
 
 #include "proto/experimental/pqcrypto/cecpq2_aead_hkdf.pb.h"
 
@@ -50,4 +50,4 @@ GetCecpq2XChaCha20Poly1305HkdfTestKey(
 }  // namespace tink
 }  // namespace crypto
 
-#endif  // TINK_EXPERIMENTAL_PQCRYPTO_CECPQ2_UTIL_TEST_UTIL_H_
+#endif  // TINK_EXPERIMENTAL_PQCRYPTO_KEM_UTIL_TEST_UTIL_H_
diff --git a/cc/experimental/pqcrypto/cecpq2/util/test_util_test.cc b/cc/experimental/pqcrypto/kem/util/test_util_test.cc
index 4cbc37e2e..ee7c3caa9 100644
--- a/cc/experimental/pqcrypto/cecpq2/util/test_util_test.cc
+++ b/cc/experimental/pqcrypto/kem/util/test_util_test.cc
@@ -14,7 +14,7 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
-#include "tink/experimental/pqcrypto/cecpq2/util/test_util.h"
+#include "tink/experimental/pqcrypto/kem/util/test_util.h"
 
 #include "gtest/gtest.h"
 #include "tink/aead/aes_gcm_key_manager.h"