diff --git a/src/main/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactory.java b/src/main/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactory.java
index cecab8df6..b8f667633 100644
--- a/src/main/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactory.java
+++ b/src/main/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactory.java
@@ -37,7 +37,7 @@ public static HpkeKem createKem(byte[] kemId) throws GeneralSecurityException {
     } else if (Arrays.equals(kemId, HpkeUtil.P521_HKDF_SHA512_KEM_ID)) {
       return NistCurvesHpkeKem.fromCurve(EllipticCurves.CurveType.NIST_P521);
     }
-    throw new IllegalArgumentException("Unrecognized HPKE KEM identifier");
+    throw new GeneralSecurityException("Unrecognized HPKE KEM identifier");
   }
 
   /** Returns an {@link HpkeKem} primitive corresponding to {@code kemId}. */
@@ -51,11 +51,11 @@ public static HpkeKem createKem(HpkeParameters.KemId kemId) throws GeneralSecuri
     } else if (kemId == HpkeParameters.KemId.DHKEM_P521_HKDF_SHA512) {
       return NistCurvesHpkeKem.fromCurve(EllipticCurves.CurveType.NIST_P521);
     }
-    throw new IllegalArgumentException("Unrecognized HPKE KEM identifier");
+    throw new GeneralSecurityException("Unrecognized HPKE KEM identifier");
   }
 
   /** Returns an {@link HpkeKdf} primitive corresponding to {@code kdfId}. */
-  public static HpkeKdf createKdf(byte[] kdfId) {
+  public static HpkeKdf createKdf(byte[] kdfId) throws GeneralSecurityException {
     if (Arrays.equals(kdfId, HpkeUtil.HKDF_SHA256_KDF_ID)) {
       return new HkdfHpkeKdf("HmacSha256");
     } else if (Arrays.equals(kdfId, HpkeUtil.HKDF_SHA384_KDF_ID)) {
@@ -63,11 +63,11 @@ public static HpkeKdf createKdf(byte[] kdfId) {
     } else if (Arrays.equals(kdfId, HpkeUtil.HKDF_SHA512_KDF_ID)) {
       return new HkdfHpkeKdf("HmacSha512");
     }
-    throw new IllegalArgumentException("Unrecognized HPKE KDF identifier");
+    throw new GeneralSecurityException("Unrecognized HPKE KDF identifier");
   }
 
   /** Returns an {@link HpkeKdf} primitive corresponding to {@code kdfId}. */
-  public static HpkeKdf createKdf(HpkeParameters.KdfId kdfId) {
+  public static HpkeKdf createKdf(HpkeParameters.KdfId kdfId) throws GeneralSecurityException {
     if (kdfId == HpkeParameters.KdfId.HKDF_SHA256) {
       return new HkdfHpkeKdf("HmacSha256");
     } else if (kdfId == HpkeParameters.KdfId.HKDF_SHA384) {
@@ -75,7 +75,7 @@ public static HpkeKdf createKdf(HpkeParameters.KdfId kdfId) {
     } else if (kdfId == HpkeParameters.KdfId.HKDF_SHA512) {
       return new HkdfHpkeKdf("HmacSha512");
     }
-    throw new IllegalArgumentException("Unrecognized HPKE KDF identifier");
+    throw new GeneralSecurityException("Unrecognized HPKE KDF identifier");
   }
 
   /** Returns an {@link HpkeAead} primitive corresponding to {@code aeadId}. */
@@ -87,7 +87,7 @@ public static HpkeAead createAead(byte[] aeadId) throws GeneralSecurityException
     } else if (Arrays.equals(aeadId, HpkeUtil.CHACHA20_POLY1305_AEAD_ID)) {
       return new ChaCha20Poly1305HpkeAead();
     }
-    throw new IllegalArgumentException("Unrecognized HPKE AEAD identifier");
+    throw new GeneralSecurityException("Unrecognized HPKE AEAD identifier");
   }
 
   /** Returns an {@link HpkeAead} primitive corresponding to {@code aeadId}. */
@@ -99,7 +99,7 @@ public static HpkeAead createAead(HpkeParameters.AeadId aeadId) throws GeneralSe
     } else if (aeadId == HpkeParameters.AeadId.CHACHA20_POLY1305) {
       return new ChaCha20Poly1305HpkeAead();
     }
-    throw new IllegalArgumentException("Unrecognized HPKE AEAD identifier");
+    throw new GeneralSecurityException("Unrecognized HPKE AEAD identifier");
   }
 
   private HpkePrimitiveFactory() {}
diff --git a/src/test/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactoryTest.java b/src/test/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactoryTest.java
index e93f73928..8e04318c4 100644
--- a/src/test/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactoryTest.java
+++ b/src/test/java/com/google/crypto/tink/hybrid/internal/HpkePrimitiveFactoryTest.java
@@ -18,6 +18,8 @@
 
 import static org.junit.Assert.assertThrows;
 
+import java.security.GeneralSecurityException;
+
 import com.google.common.truth.Expect;
 import com.google.crypto.tink.hybrid.HpkeParameters;
 import org.junit.Rule;
@@ -147,7 +149,7 @@ public void createKem_fromInvalidKemBytesId_fails() {
     byte[] invalidKemId = new byte[] {0, 0};
 
     assertThrows(
-        IllegalArgumentException.class, () -> HpkePrimitiveFactory.createKem(invalidKemId));
+        GeneralSecurityException.class, () -> HpkePrimitiveFactory.createKem(invalidKemId));
   }
 
   @Theory
@@ -173,7 +175,7 @@ public void createKdf_fromInvalidKdfBytesId_fails() {
     byte[] invalidKdfId = new byte[] {0, 0};
 
     assertThrows(
-        IllegalArgumentException.class, () -> HpkePrimitiveFactory.createKdf(invalidKdfId));
+        GeneralSecurityException.class, () -> HpkePrimitiveFactory.createKdf(invalidKdfId));
   }
 
   @Theory
@@ -201,7 +203,7 @@ public void createAead_fromInvalidAeadBytesId_fails() {
     byte[] invalidAeadId = new byte[] {0, 0};
 
     assertThrows(
-        IllegalArgumentException.class, () -> HpkePrimitiveFactory.createAead(invalidAeadId));
+        GeneralSecurityException.class, () -> HpkePrimitiveFactory.createAead(invalidAeadId));
   }
 
   @Theory