diff --git a/quiche/oblivious_http/common/oblivious_http_header_key_config.cc b/quiche/oblivious_http/common/oblivious_http_header_key_config.cc
index 6393fd7..3fd170f 100644
--- a/quiche/oblivious_http/common/oblivious_http_header_key_config.cc
+++ b/quiche/oblivious_http/common/oblivious_http_header_key_config.cc
@@ -43,7 +43,8 @@
     case EVP_HPKE_DHKEM_X25519_HKDF_SHA256:
       return EVP_hpke_x25519_hkdf_sha256();
     default:
-      return absl::UnimplementedError("No support for this KEM ID.");
+      return absl::UnimplementedError(
+          absl::StrCat("KEM ID", absl::Hex(kem_id), " not supported"));
   }
 }
 
@@ -52,7 +53,8 @@
     case EVP_HPKE_HKDF_SHA256:
       return EVP_hpke_hkdf_sha256();
     default:
-      return absl::UnimplementedError("No support for this KDF ID.");
+      return absl::UnimplementedError(
+          absl::StrCat("KDF ID ", absl::Hex(kdf_id), " not supported"));
   }
 }
 
@@ -65,7 +67,8 @@
     case EVP_HPKE_CHACHA20_POLY1305:
       return EVP_hpke_chacha20_poly1305();
     default:
-      return absl::UnimplementedError("No support for this AEAD ID.");
+      return absl::UnimplementedError(
+          absl::StrCat("AEAD ID ", absl::Hex(aead_id), " not supported"));
   }
 }
 
@@ -86,38 +89,26 @@
 }
 
 absl::Status ObliviousHttpHeaderKeyConfig::ValidateKeyConfig() const {
-  auto supported_kem = CheckKemId(kem_id_);
-  if (!supported_kem.ok()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Unsupported KEM ID:", kem_id_));
-  }
-  auto supported_kdf = CheckKdfId(kdf_id_);
-  if (!supported_kdf.ok()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Unsupported KDF ID:", kdf_id_));
-  }
-  auto supported_aead = CheckAeadId(aead_id_);
-  if (!supported_aead.ok()) {
-    return absl::InvalidArgumentError(
-        absl::StrCat("Unsupported AEAD ID:", aead_id_));
-  }
+  QUICHE_RETURN_IF_ERROR(CheckKemId(kem_id_).status());
+  QUICHE_RETURN_IF_ERROR(CheckKdfId(kdf_id_).status());
+  QUICHE_RETURN_IF_ERROR(CheckAeadId(aead_id_).status());
   return absl::OkStatus();
 }
 
 const EVP_HPKE_KEM* ObliviousHttpHeaderKeyConfig::GetHpkeKem() const {
   auto kem = CheckKemId(kem_id_);
   QUICHE_CHECK_OK(kem.status());
-  return kem.value();
+  return *kem;
 }
 const EVP_HPKE_KDF* ObliviousHttpHeaderKeyConfig::GetHpkeKdf() const {
   auto kdf = CheckKdfId(kdf_id_);
   QUICHE_CHECK_OK(kdf.status());
-  return kdf.value();
+  return *kdf;
 }
 const EVP_HPKE_AEAD* ObliviousHttpHeaderKeyConfig::GetHpkeAead() const {
   auto aead = CheckAeadId(aead_id_);
   QUICHE_CHECK_OK(aead.status());
-  return aead.value();
+  return *aead;
 }
 
 std::string ObliviousHttpHeaderKeyConfig::SerializeRecipientContextInfo(
@@ -127,7 +118,7 @@
   std::string info(buf_len, '\0');
   QuicheDataWriter writer(info.size(), info.data());
   QUICHE_CHECK(writer.WriteStringPiece(request_label));
-  QUICHE_CHECK(writer.WriteUInt8(zero_byte));  // Zero byte.
+  QUICHE_CHECK(writer.WriteUInt8(zero_byte));
   QUICHE_CHECK(writer.WriteUInt8(key_id_));
   QUICHE_CHECK(writer.WriteUInt16(kem_id_));
   QUICHE_CHECK(writer.WriteUInt16(kdf_id_));
@@ -139,7 +130,7 @@
 absl::Status ObliviousHttpHeaderKeyConfig::ParseOhttpPayloadHeader(
     absl::string_view payload_bytes) const {
   if (payload_bytes.empty()) {
-    return absl::InvalidArgumentError("Empty request payload.");
+    return absl::InvalidArgumentError("Empty request payload");
   }
   QuicheDataReader reader(payload_bytes);
   return ParseOhttpPayloadHeader(reader);
@@ -149,38 +140,40 @@
     QuicheDataReader& reader) const {
   uint8_t key_id;
   if (!reader.ReadUInt8(&key_id)) {
-    return absl::InvalidArgumentError("Failed to read key_id from header.");
+    return absl::InvalidArgumentError("Failed to read key_id from header");
   }
   if (key_id != key_id_) {
     return absl::InvalidArgumentError(
-        absl::StrCat("KeyID in request:", static_cast<uint16_t>(key_id),
-                     " doesn't match with server's public key "
-                     "configuration KeyID:",
-                     static_cast<uint16_t>(key_id_)));
+        absl::StrCat("KeyID ", static_cast<uint16_t>(key_id),
+                     " in request does not match KeyID ",
+                     static_cast<uint16_t>(key_id_), " from config"));
   }
   uint16_t kem_id;
   if (!reader.ReadUInt16(&kem_id)) {
-    return absl::InvalidArgumentError("Failed to read kem_id from header.");
+    return absl::InvalidArgumentError("Failed to read kem_id from header");
   }
   if (kem_id != kem_id_) {
     return absl::InvalidArgumentError(
-        absl::StrCat("Received Invalid kemID:", kem_id, " Expected:", kem_id_));
+        absl::StrCat("Received invalid kem_id ", absl::Hex(kem_id),
+                     ", expected ", absl::Hex(kem_id_)));
   }
   uint16_t kdf_id;
   if (!reader.ReadUInt16(&kdf_id)) {
-    return absl::InvalidArgumentError("Failed to read kdf_id from header.");
+    return absl::InvalidArgumentError("Failed to read kdf_id from header");
   }
   if (kdf_id != kdf_id_) {
     return absl::InvalidArgumentError(
-        absl::StrCat("Received Invalid kdfID:", kdf_id, " Expected:", kdf_id_));
+        absl::StrCat("Received invalid kdf_id ", absl::Hex(kdf_id),
+                     ", expected ", absl::Hex(kdf_id_)));
   }
   uint16_t aead_id;
   if (!reader.ReadUInt16(&aead_id)) {
-    return absl::InvalidArgumentError("Failed to read aead_id from header.");
+    return absl::InvalidArgumentError("Failed to read aead_id from header");
   }
   if (aead_id != aead_id_) {
-    return absl::InvalidArgumentError(absl::StrCat(
-        "Received Invalid aeadID:", aead_id, " Expected:", aead_id_));
+    return absl::InvalidArgumentError(
+        absl::StrCat("Received invalid aead_id ", absl::Hex(aead_id),
+                     ", expected ", absl::Hex(aead_id_)));
   }
   return absl::OkStatus();
 }
@@ -189,12 +182,12 @@
 ObliviousHttpHeaderKeyConfig::ParseKeyIdFromObliviousHttpRequestPayload(
     absl::string_view payload_bytes) {
   if (payload_bytes.empty()) {
-    return absl::InvalidArgumentError("Empty request payload.");
+    return absl::InvalidArgumentError("Empty request payload");
   }
   QuicheDataReader reader(payload_bytes);
   uint8_t key_id;
   if (!reader.ReadUInt8(&key_id)) {
-    return absl::InvalidArgumentError("Failed to read key_id from payload.");
+    return absl::InvalidArgumentError("Failed to read key_id from payload");
   }
   return key_id;
 }
@@ -205,34 +198,33 @@
   std::string hdr(buf_len, '\0');
   QuicheDataWriter writer(hdr.size(), hdr.data());
   QUICHE_CHECK(writer.WriteUInt8(key_id_));
-  QUICHE_CHECK(writer.WriteUInt16(kem_id_));   // kemID
-  QUICHE_CHECK(writer.WriteUInt16(kdf_id_));   // kdfID
-  QUICHE_CHECK(writer.WriteUInt16(aead_id_));  // aeadID
+  QUICHE_CHECK(writer.WriteUInt16(kem_id_));
+  QUICHE_CHECK(writer.WriteUInt16(kdf_id_));
+  QUICHE_CHECK(writer.WriteUInt16(aead_id_));
   return hdr;
 }
 
 namespace {
 // https://www.rfc-editor.org/rfc/rfc9180#section-7.1
 absl::StatusOr<uint16_t> KeyLength(uint16_t kem_id) {
-  auto supported_kem = CheckKemId(kem_id);
-  if (!supported_kem.ok()) {
-    return absl::InvalidArgumentError(absl::StrCat(
-        "Unsupported KEM ID:", kem_id, ". public key length is unknown."));
-  }
-  return EVP_HPKE_KEM_public_key_len(supported_kem.value());
+  QUICHE_ASSIGN_OR_RETURN(const EVP_HPKE_KEM* supported_kem,
+                          CheckKemId(kem_id));
+  return EVP_HPKE_KEM_public_key_len(supported_kem);
 }
 
 absl::StatusOr<std::string> SerializeOhttpKeyWithPublicKey(
     uint8_t key_id, absl::string_view public_key,
     const std::vector<ObliviousHttpHeaderKeyConfig>& ohttp_configs) {
+  if (ohttp_configs.empty()) {
+    return absl::InvalidArgumentError("Empty ohttp_configs");
+  }
   auto ohttp_config = ohttp_configs[0];
-  // Check if `ohttp_config` match the RFC's encoding guidelines.
   static_assert(sizeof(ohttp_config.GetHpkeKemId()) == kSizeOfHpkeKemId &&
                     sizeof(ohttp_config.GetHpkeKdfId()) ==
                         kSizeOfSymmetricAlgorithmHpkeKdfId &&
                     sizeof(ohttp_config.GetHpkeAeadId()) ==
                         kSizeOfSymmetricAlgorithmHpkeAeadId,
-                "Size of HPKE IDs should match RFC specification.");
+                "Bad algorithm ID sizes");
 
   uint16_t symmetric_algs_length =
       ohttp_configs.size() * (kSizeOfSymmetricAlgorithmHpkeKdfId +
@@ -242,61 +234,28 @@
   std::string ohttp_key_configuration(buf_len, '\0');
   QuicheDataWriter writer(ohttp_key_configuration.size(),
                           ohttp_key_configuration.data());
-  if (!writer.WriteUInt8(key_id)) {
-    return absl::InternalError("Failed to serialize OHTTP key.[key_id]");
-  }
-  if (!writer.WriteUInt16(ohttp_config.GetHpkeKemId())) {
-    return absl::InternalError(
-        "Failed to serialize OHTTP key.[kem_id]");  // kemID.
-  }
-  if (!writer.WriteStringPiece(public_key)) {
-    return absl::InternalError(
-        "Failed to serialize OHTTP key.[public_key]");  // Raw public key.
-  }
-  if (!writer.WriteUInt16(symmetric_algs_length)) {
-    return absl::InternalError(
-        "Failed to serialize OHTTP key.[symmetric_algs_length]");
-  }
+  QUICHE_CHECK(writer.WriteUInt8(key_id));
+  QUICHE_CHECK(writer.WriteUInt16(ohttp_config.GetHpkeKemId()));
+  QUICHE_CHECK(writer.WriteStringPiece(public_key));
+  QUICHE_CHECK(writer.WriteUInt16(symmetric_algs_length));
   for (const auto& item : ohttp_configs) {
     // Check if KEM ID is the same for all the configs stored in `this` for
     // given `key_id`.
     if (item.GetHpkeKemId() != ohttp_config.GetHpkeKemId()) {
-      QUICHE_BUG(ohttp_key_configs_builder_parser)
-          << "ObliviousHttpKeyConfigs object cannot hold ConfigMap of "
-             "different KEM IDs:[ "
-          << item.GetHpkeKemId() << "," << ohttp_config.GetHpkeKemId()
-          << " ]for a given key_id:" << static_cast<uint16_t>(key_id);
-    }
-    if (!writer.WriteUInt16(item.GetHpkeKdfId())) {
       return absl::InternalError(
-          "Failed to serialize OHTTP key.[kdf_id]");  // kdfID.
+          absl::StrCat("ObliviousHttpKeyConfigs object cannot hold ConfigMap "
+                       "of different KEM IDs ",
+                       absl::Hex(item.GetHpkeKemId()), " vs ",
+                       absl::Hex(ohttp_config.GetHpkeKemId()), " for key_id ",
+                       static_cast<uint16_t>(key_id)));
     }
-    if (!writer.WriteUInt16(item.GetHpkeAeadId())) {
-      return absl::InternalError(
-          "Failed to serialize OHTTP key.[aead_id]");  // aeadID.
-    }
+    QUICHE_CHECK(writer.WriteUInt16(item.GetHpkeKdfId()));
+    QUICHE_CHECK(writer.WriteUInt16(item.GetHpkeAeadId()));
   }
-  QUICHE_DCHECK_EQ(writer.remaining(), 0u);
+  QUICHE_CHECK_EQ(writer.remaining(), 0u);
   return ohttp_key_configuration;
 }
 
-std::string GetDebugStringForFailedKeyConfig(
-    const ObliviousHttpKeyConfigs::OhttpKeyConfig& failed_key_config) {
-  std::string debug_string = "[ ";
-  absl::StrAppend(&debug_string,
-                  "key_id:", static_cast<uint16_t>(failed_key_config.key_id),
-                  " , kem_id:", failed_key_config.kem_id,
-                  ". Printing HEX formatted public_key:",
-                  absl::BytesToHexString(failed_key_config.public_key));
-  absl::StrAppend(&debug_string, ", symmetric_algorithms: { ");
-  for (const auto& symmetric_config : failed_key_config.symmetric_algorithms) {
-    absl::StrAppend(&debug_string, "{kdf_id: ", symmetric_config.kdf_id,
-                    ", aead_id:", symmetric_config.aead_id, " }");
-  }
-  absl::StrAppend(&debug_string, " } ]");
-  return debug_string;
-}
-
 // Verifies if the `key_config` contains all valid combinations of [kem_id,
 // kdf_id, aead_id] that comprises Single Key configuration encoding as
 // specified in
@@ -306,27 +265,20 @@
     absl::btree_map<uint8_t, std::vector<ObliviousHttpHeaderKeyConfig>,
                     std::greater<uint8_t>>& configs,
     absl::flat_hash_map<uint8_t, std::string>& keys) {
-  if (!CheckKemId(key_config.kem_id).ok() ||
-      key_config.public_key.size() != KeyLength(key_config.kem_id).value()) {
-    QUICHE_LOG(ERROR) << "Failed to process: "
-                      << GetDebugStringForFailedKeyConfig(key_config);
-    return absl::InvalidArgumentError(
-        absl::StrCat("Invalid key_config! [KEM ID:", key_config.kem_id, "]"));
+  QUICHE_ASSIGN_OR_RETURN(uint16_t key_length, KeyLength(key_config.kem_id));
+  if (key_length != key_config.public_key.size()) {
+    return absl::InvalidArgumentError(absl::StrCat(
+        "Invalid key length ", key_config.public_key.size(), " for KEM ID ",
+        absl::Hex(key_config.kem_id), ", expected ", key_length));
   }
   for (const auto& symmetric_config : key_config.symmetric_algorithms) {
-    if (!CheckKdfId(symmetric_config.kdf_id).ok() ||
-        !CheckAeadId(symmetric_config.aead_id).ok()) {
-      QUICHE_LOG(ERROR) << "Failed to process: "
-                        << GetDebugStringForFailedKeyConfig(key_config);
-      return absl::InvalidArgumentError(
-          absl::StrCat("Invalid key_config! [KDF ID:", symmetric_config.kdf_id,
-                       ", AEAD ID:", symmetric_config.aead_id, "]"));
-    }
+    QUICHE_RETURN_IF_ERROR(CheckKdfId(symmetric_config.kdf_id).status());
+    QUICHE_RETURN_IF_ERROR(CheckAeadId(symmetric_config.aead_id).status());
     auto ohttp_config = ObliviousHttpHeaderKeyConfig::Create(
         key_config.key_id, key_config.kem_id, symmetric_config.kdf_id,
         symmetric_config.aead_id);
     if (ohttp_config.ok()) {
-      configs[key_config.key_id].emplace_back(std::move(ohttp_config.value()));
+      configs[key_config.key_id].emplace_back(std::move(*ohttp_config));
     }
   }
   keys.emplace(key_config.key_id, std::move(key_config.public_key));
@@ -348,37 +300,29 @@
 }
 
 absl::StatusOr<ObliviousHttpKeyConfigs> ObliviousHttpKeyConfigs::Create(
-    absl::flat_hash_set<ObliviousHttpKeyConfigs::OhttpKeyConfig>
-        ohttp_key_configs) {
+    absl::flat_hash_set<OhttpKeyConfig> ohttp_key_configs) {
   if (ohttp_key_configs.empty()) {
-    return absl::InvalidArgumentError("Empty input.");
+    return absl::InvalidArgumentError("Empty input");
   }
   ConfigMap configs_map;
   PublicKeyMap keys_map;
-  for (auto& ohttp_key_config : ohttp_key_configs) {
-    auto result = StoreKeyConfigIfValid(std::move(ohttp_key_config),
-                                        configs_map, keys_map);
-    if (!result.ok()) {
-      return result;
-    }
+  for (OhttpKeyConfig ohttp_key_config : ohttp_key_configs) {
+    QUICHE_RETURN_IF_ERROR(StoreKeyConfigIfValid(std::move(ohttp_key_config),
+                                                 configs_map, keys_map));
   }
-  auto oblivious_configs =
-      ObliviousHttpKeyConfigs(std::move(configs_map), std::move(keys_map));
-  return oblivious_configs;
+  return ObliviousHttpKeyConfigs(std::move(configs_map), std::move(keys_map));
 }
 
 absl::StatusOr<ObliviousHttpKeyConfigs> ObliviousHttpKeyConfigs::Create(
     const ObliviousHttpHeaderKeyConfig& single_key_config,
     absl::string_view public_key) {
-  if (public_key.empty()) {
-    return absl::InvalidArgumentError("Empty input.");
-  }
-
-  if (auto key_length = KeyLength(single_key_config.GetHpkeKemId());
-      public_key.size() != key_length.value()) {
-    return absl::InvalidArgumentError(absl::StrCat(
-        "Invalid key. Key size mismatch. Expected:", key_length.value(),
-        " Actual:", public_key.size()));
+  QUICHE_ASSIGN_OR_RETURN(uint16_t key_length,
+                          KeyLength(single_key_config.GetHpkeKemId()));
+  if (key_length != public_key.size()) {
+    return absl::InvalidArgumentError(
+        absl::StrCat("Invalid key length ", public_key.size(), " for KEM ID ",
+                     absl::Hex(single_key_config.GetHpkeKemId()), ", expected ",
+                     key_length));
   }
 
   ConfigMap configs;
@@ -393,23 +337,19 @@
     const {
   std::string concatenated_keys;
   for (const auto& [key_id, ohttp_configs] : configs_) {
-    auto key = public_keys_.find(key_id);
-    if (key == public_keys_.end()) {
-      return absl::InternalError(
-          "Failed to serialize. No public key found for key_id");
-    }
-    auto serialized =
-        SerializeOhttpKeyWithPublicKey(key_id, key->second, ohttp_configs);
-    if (!serialized.ok()) {
-      return absl::InternalError("Failed to serialize OHTTP key configs.");
-    }
-    absl::StrAppend(&concatenated_keys, serialized.value());
+    QUICHE_ASSIGN_OR_RETURN(absl::string_view public_key,
+                            GetPublicKeyForId(key_id));
+    QUICHE_ASSIGN_OR_RETURN(
+        std::string serialized,
+        SerializeOhttpKeyWithPublicKey(key_id, public_key, ohttp_configs));
+    absl::StrAppend(&concatenated_keys, std::move(serialized));
   }
   return concatenated_keys;
 }
 
 ObliviousHttpHeaderKeyConfig ObliviousHttpKeyConfigs::PreferredConfig() const {
   // configs_ is forced to have at least one object during construction.
+  QUICHE_CHECK(!configs_.empty());
   return configs_.begin()->second.front();
 }
 
@@ -417,7 +357,8 @@
     uint8_t key_id) const {
   auto key = public_keys_.find(key_id);
   if (key == public_keys_.end()) {
-    return absl::NotFoundError("No public key found for key_id");
+    return absl::NotFoundError(
+        absl::StrCat("No public key found for key_id", key_id));
   }
   return key->second;
 }
@@ -425,34 +366,36 @@
 absl::Status ObliviousHttpKeyConfigs::ReadSingleKeyConfig(
     QuicheDataReader& reader, ConfigMap& configs, PublicKeyMap& keys) {
   uint8_t key_id;
-  uint16_t kem_id;
-  // First byte: key_id; next two bytes: kem_id.
-  if (!reader.ReadUInt8(&key_id) || !reader.ReadUInt16(&kem_id)) {
-    return absl::InvalidArgumentError("Invalid key_config!");
+  if (!reader.ReadUInt8(&key_id)) {
+    return absl::InvalidArgumentError("Failed to read key_id");
   }
-
-  // Public key length depends on the kem_id.
+  uint16_t kem_id;
+  if (!reader.ReadUInt16(&kem_id)) {
+    return absl::InvalidArgumentError("Failed to read kem_id");
+  }
   QUICHE_ASSIGN_OR_RETURN(uint16_t key_length, KeyLength(kem_id));
   std::string key_str(key_length, '\0');
-  if (!reader.ReadBytes(key_str.data(), key_length)) {
-    return absl::InvalidArgumentError("Invalid key_config!");
+  if (!reader.ReadBytes(key_str.data(), key_str.size())) {
+    return absl::InvalidArgumentError("Failed to read public key");
   }
   if (!keys.insert({key_id, std::move(key_str)}).second) {
-    return absl::InvalidArgumentError("Duplicate key_id's in key_config!");
+    return absl::InvalidArgumentError(
+        absl::StrCat("Found duplicated key_id ", key_id));
   }
 
-  // Extract the algorithms for this public key.
   absl::string_view alg_bytes;
-  // Read the 16-bit length, then read that many bytes into alg_bytes.
   if (!reader.ReadStringPiece16(&alg_bytes)) {
-    return absl::InvalidArgumentError("Invalid key_config!");
+    return absl::InvalidArgumentError("Failed to read symmetric algorithms");
   }
   QuicheDataReader sub_reader(alg_bytes);
   while (!sub_reader.IsDoneReading()) {
     uint16_t kdf_id;
+    if (!sub_reader.ReadUInt16(&kdf_id)) {
+      return absl::InvalidArgumentError("Failed to read kdf_id");
+    }
     uint16_t aead_id;
-    if (!sub_reader.ReadUInt16(&kdf_id) || !sub_reader.ReadUInt16(&aead_id)) {
-      return absl::InvalidArgumentError("Invalid key_config!");
+    if (!sub_reader.ReadUInt16(&aead_id)) {
+      return absl::InvalidArgumentError("Failed to read aead_id");
     }
 
     // TODO(kmg): Add support to ignore key types in the server response that
@@ -462,6 +405,9 @@
         ObliviousHttpHeaderKeyConfig::Create(key_id, kem_id, kdf_id, aead_id));
     configs[key_id].emplace_back(std::move(cfg));
   }
+  // Intentionally allow extra data at the end of the key config. This will
+  // allow us to use it for extensions. See
+  // draft-schinazi-httpbis-ohttp-ext-key-config.
   return absl::OkStatus();
 }
 
diff --git a/quiche/oblivious_http/common/oblivious_http_header_key_config.h b/quiche/oblivious_http/common/oblivious_http_header_key_config.h
index 9e48336..e20e67e 100644
--- a/quiche/oblivious_http/common/oblivious_http_header_key_config.h
+++ b/quiche/oblivious_http/common/oblivious_http_header_key_config.h
@@ -3,8 +3,10 @@
 
 #include <stdint.h>
 
+#include <functional>
 #include <string>
 #include <utility>
+#include <vector>
 
 #include "absl/container/btree_map.h"
 #include "absl/container/flat_hash_map.h"
diff --git a/quiche/oblivious_http/common/oblivious_http_header_key_config_test.cc b/quiche/oblivious_http/common/oblivious_http_header_key_config_test.cc
index fb3688d..6e831fc 100644
--- a/quiche/oblivious_http/common/oblivious_http_header_key_config_test.cc
+++ b/quiche/oblivious_http/common/oblivious_http_header_key_config_test.cc
@@ -9,22 +9,19 @@
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
 #include "openssl/hpke.h"
-#include "quiche/common/platform/api/quiche_logging.h"
 #include "quiche/common/platform/api/quiche_test.h"
 #include "quiche/common/quiche_data_writer.h"
+#include "quiche/common/test_tools/quiche_test_utils.h"
 
 namespace quiche {
 namespace {
+using ::quiche::test::IsOkAndHolds;
 using ::testing::AllOf;
 using ::testing::HasSubstr;
 using ::testing::Property;
-using ::testing::StrEq;
 using ::testing::UnorderedElementsAre;
 using ::testing::UnorderedElementsAreArray;
 
-/**
- * Build Request header.
- */
 std::string BuildHeader(uint8_t key_id, uint16_t kem_id, uint16_t kdf_id,
                         uint16_t aead_id) {
   int buf_len =
@@ -32,9 +29,9 @@
   std::string hdr(buf_len, '\0');
   QuicheDataWriter writer(hdr.size(), hdr.data());
   EXPECT_TRUE(writer.WriteUInt8(key_id));
-  EXPECT_TRUE(writer.WriteUInt16(kem_id));   // kemID
-  EXPECT_TRUE(writer.WriteUInt16(kdf_id));   // kdfID
-  EXPECT_TRUE(writer.WriteUInt16(aead_id));  // aeadID
+  EXPECT_TRUE(writer.WriteUInt16(kem_id));
+  EXPECT_TRUE(writer.WriteUInt16(kdf_id));
+  EXPECT_TRUE(writer.WriteUInt16(aead_id));
   return hdr;
 }
 
@@ -75,9 +72,8 @@
   expected.insert(expected.end(), ohttp_cfg.begin(), ohttp_cfg.end());
   auto instance =
       ObliviousHttpHeaderKeyConfig::Create(key_id, kem_id, kdf_id, aead_id);
-  ASSERT_TRUE(instance.ok());
-  EXPECT_EQ(instance.value().SerializeRecipientContextInfo(ohttp_req_label),
-            expected);
+  QUICHE_ASSERT_OK(instance);
+  EXPECT_EQ(instance->SerializeRecipientContextInfo(ohttp_req_label), expected);
   EXPECT_THAT(instance->DebugString(), HasSubstr("AES-256-GCM"));
 }
 
@@ -95,44 +91,47 @@
   auto valid_key_config = ObliviousHttpHeaderKeyConfig::Create(
       2, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_AES_256_GCM);
-  ASSERT_TRUE(valid_key_config.ok());
+  QUICHE_ASSERT_OK(valid_key_config);
   EXPECT_THAT(valid_key_config->DebugString(), HasSubstr("AES-256-GCM"));
 }
 
 TEST(ObliviousHttpHeaderKeyConfig, TestInvalidKeyConfig) {
-  auto invalid_kem = ObliviousHttpHeaderKeyConfig::Create(
-      3, 0, EVP_HPKE_HKDF_SHA256, EVP_HPKE_AES_256_GCM);
-  EXPECT_EQ(invalid_kem.status().code(), absl::StatusCode::kInvalidArgument);
-  auto invalid_kdf = ObliviousHttpHeaderKeyConfig::Create(
-      3, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, 0, EVP_HPKE_AES_256_GCM);
-  EXPECT_EQ(invalid_kdf.status().code(), absl::StatusCode::kInvalidArgument);
-  auto invalid_aead = ObliviousHttpHeaderKeyConfig::Create(
-      3, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256, 0);
-  EXPECT_EQ(invalid_kdf.status().code(), absl::StatusCode::kInvalidArgument);
+  EXPECT_FALSE(ObliviousHttpHeaderKeyConfig::Create(3, 0, EVP_HPKE_HKDF_SHA256,
+                                                    EVP_HPKE_AES_256_GCM)
+                   .ok());
+  EXPECT_FALSE(
+      ObliviousHttpHeaderKeyConfig::Create(3, EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
+                                           0, EVP_HPKE_AES_256_GCM)
+          .ok());
+  EXPECT_FALSE(
+      ObliviousHttpHeaderKeyConfig::Create(3, EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
+                                           EVP_HPKE_HKDF_SHA256, 0)
+          .ok());
 }
 
 TEST(ObliviousHttpHeaderKeyConfig, TestParsingValidHeader) {
   auto instance = ObliviousHttpHeaderKeyConfig::Create(
       5, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_AES_256_GCM);
-  ASSERT_TRUE(instance.ok());
-  std::string good_hdr(BuildHeader(5, EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
-                                   EVP_HPKE_HKDF_SHA256, EVP_HPKE_AES_256_GCM));
-  ASSERT_TRUE(instance.value().ParseOhttpPayloadHeader(good_hdr).ok());
+  QUICHE_ASSERT_OK(instance);
+  std::string good_hdr =
+      BuildHeader(5, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
+                  EVP_HPKE_AES_256_GCM);
+  QUICHE_ASSERT_OK(instance->ParseOhttpPayloadHeader(good_hdr));
 }
 
 TEST(ObliviousHttpHeaderKeyConfig, TestParsingInvalidHeader) {
   auto instance = ObliviousHttpHeaderKeyConfig::Create(
       8, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_AES_256_GCM);
-  ASSERT_TRUE(instance.ok());
-  std::string keyid_mismatch_hdr(
+  QUICHE_ASSERT_OK(instance);
+  std::string keyid_mismatch_hdr =
       BuildHeader(0, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
-                  EVP_HPKE_AES_256_GCM));
-  EXPECT_EQ(instance.value().ParseOhttpPayloadHeader(keyid_mismatch_hdr).code(),
+                  EVP_HPKE_AES_256_GCM);
+  EXPECT_EQ(instance->ParseOhttpPayloadHeader(keyid_mismatch_hdr).code(),
             absl::StatusCode::kInvalidArgument);
-  std::string invalid_hpke_hdr(BuildHeader(8, 0, 0, 0));
-  EXPECT_EQ(instance.value().ParseOhttpPayloadHeader(invalid_hpke_hdr).code(),
+  std::string invalid_hpke_hdr = BuildHeader(8, 0, 0, 0);
+  EXPECT_EQ(instance->ParseOhttpPayloadHeader(invalid_hpke_hdr).code(),
             absl::StatusCode::kInvalidArgument);
 }
 
@@ -143,16 +142,16 @@
   auto parsed_key_id =
       ObliviousHttpHeaderKeyConfig::ParseKeyIdFromObliviousHttpRequestPayload(
           key_id);
-  ASSERT_TRUE(parsed_key_id.ok());
-  EXPECT_EQ(parsed_key_id.value(), 99);
+  QUICHE_ASSERT_OK(parsed_key_id);
+  EXPECT_EQ(*parsed_key_id, 99);
 }
 
 TEST(ObliviousHttpHeaderKeyConfig, TestCopyable) {
   auto obj1 = ObliviousHttpHeaderKeyConfig::Create(
       4, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_AES_256_GCM);
-  ASSERT_TRUE(obj1.ok());
-  auto copy_obj1_to_obj2 = obj1.value();
+  QUICHE_ASSERT_OK(obj1);
+  auto copy_obj1_to_obj2 = *obj1;
   EXPECT_EQ(copy_obj1_to_obj2.kHeaderLength, obj1->kHeaderLength);
   EXPECT_EQ(copy_obj1_to_obj2.SerializeRecipientContextInfo(),
             obj1->SerializeRecipientContextInfo());
@@ -162,7 +161,7 @@
   auto instance = ObliviousHttpHeaderKeyConfig::Create(
       7, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_AES_128_GCM);
-  ASSERT_TRUE(instance.ok());
+  QUICHE_ASSERT_OK(instance);
   EXPECT_EQ(instance->SerializeOhttpPayloadHeader(),
             BuildHeader(7, EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
                         EVP_HPKE_HKDF_SHA256, EVP_HPKE_AES_128_GCM));
@@ -188,35 +187,49 @@
 
 TEST(ObliviousHttpKeyConfigs, SingleKeyConfig) {
   std::string key;
-  ASSERT_TRUE(absl::HexStringToBytes(
-      "4b0020f83e0a17cbdb18d2684dd2a9b087a43e5f3fa3fa27a049bc746a6e97a1e0244b00"
-      "0400010002",
-      &key));
-  auto configs = ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key).value();
-  EXPECT_THAT(configs, Property(&ObliviousHttpKeyConfigs::NumKeys, 1));
+  ASSERT_TRUE(
+      absl::HexStringToBytes("4b"                                // key_id
+                             "0020"                              // kem_id
+                             "606162636465666768696a6b6c6d6e6f"  // public_key
+                             "707172737475767778797a7b7c7d7e7f"  // public_key
+                             "0004"       // len(symmetric_algorithms)
+                             "00010002",  // HKDF_SHA256, AES_256_GCM
+                             &key));
+  auto configs = ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key);
+  QUICHE_ASSERT_OK(configs);
+  EXPECT_THAT(*configs, Property(&ObliviousHttpKeyConfigs::NumKeys, 1));
   EXPECT_THAT(
-      configs.PreferredConfig(),
+      configs->PreferredConfig(),
       AllOf(HasKeyId(0x4b), HasKemId(EVP_HPKE_DHKEM_X25519_HKDF_SHA256),
             HasKdfId(EVP_HPKE_HKDF_SHA256), HasAeadId(EVP_HPKE_AES_256_GCM)));
   std::string expected_public_key;
   ASSERT_TRUE(absl::HexStringToBytes(
-      "f83e0a17cbdb18d2684dd2a9b087a43e5f3fa3fa27a049bc746a6e97a1e0244b",
+      "606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f",
       &expected_public_key));
-  EXPECT_THAT(
-      configs.GetPublicKeyForId(configs.PreferredConfig().GetKeyId()).value(),
-      StrEq(expected_public_key));
+  EXPECT_THAT(configs->GetPublicKeyForId(configs->PreferredConfig().GetKeyId()),
+              IsOkAndHolds(expected_public_key));
 }
 
 TEST(ObliviousHttpKeyConfigs, TwoSimilarKeyConfigs) {
   std::string key;
   ASSERT_TRUE(absl::HexStringToBytes(
-      "4b0020f83e0a17cbdb18d2684dd2a9b087a43e5f3fa3fa27a049bc746a6e97a1e0244b00"
-      "0400010002"  // Intentional concatenation
-      "4f0020f83e0a17cbdb18d2684dd2a9b087a43e5f3fa3fa27a049bc746a6e97a1e0244b00"
-      "0400010001",
+      // First key config.
+      "4b"                                // key_id
+      "0020"                              // kem_id
+      "606162636465666768696a6b6c6d6e6f"  // public_key
+      "707172737475767778797a7b7c7d7e7f"  // public_key
+      "0004"                              // len(symmetric_algorithms)
+      "00010002"                          // HKDF_SHA256, AES_256_GCM
+      // Second key config.
+      "4f"                                // key_id
+      "0020"                              // kem_id
+      "606162636465666768696a6b6c6d6e6f"  // public_key
+      "707172737475767778797a7b7c7d7e7f"  // public_key
+      "0004"                              // len(symmetric_algorithms)
+      "00010001",                         // HKDF_SHA256, AES_128_GCM
       &key));
-  EXPECT_THAT(ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key).value(),
-              Property(&ObliviousHttpKeyConfigs::NumKeys, 2));
+  EXPECT_THAT(ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key),
+              IsOkAndHolds(Property(&ObliviousHttpKeyConfigs::NumKeys, 2)));
   EXPECT_THAT(
       ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key)->PreferredConfig(),
       AllOf(HasKeyId(0x4f), HasKemId(EVP_HPKE_DHKEM_X25519_HKDF_SHA256),
@@ -229,30 +242,40 @@
       "01002031e1f05a740102115220e9af918f738674aec95f54db6e04eb705aae8e79815500"
       "080001000100010003",
       &key));
-  auto configs = ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key).value();
-  EXPECT_THAT(configs, Property(&ObliviousHttpKeyConfigs::NumKeys, 1));
+  auto configs = ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key);
+  QUICHE_ASSERT_OK(configs);
+  EXPECT_THAT(*configs, Property(&ObliviousHttpKeyConfigs::NumKeys, 1));
   EXPECT_THAT(
-      configs.PreferredConfig(),
+      configs->PreferredConfig(),
       AllOf(HasKeyId(0x01), HasKemId(EVP_HPKE_DHKEM_X25519_HKDF_SHA256),
             HasKdfId(EVP_HPKE_HKDF_SHA256), HasAeadId(EVP_HPKE_AES_128_GCM)));
   std::string expected_public_key;
   ASSERT_TRUE(absl::HexStringToBytes(
       "31e1f05a740102115220e9af918f738674aec95f54db6e04eb705aae8e798155",
       &expected_public_key));
-  EXPECT_THAT(
-      configs.GetPublicKeyForId(configs.PreferredConfig().GetKeyId()).value(),
-      StrEq(expected_public_key));
-  EXPECT_THAT(configs.DebugString(), HasSubstr("AES-128-GCM"));
-  EXPECT_THAT(configs.DebugString(), HasSubstr("31e1f05a7401"));
+  EXPECT_THAT(configs->GetPublicKeyForId(configs->PreferredConfig().GetKeyId()),
+              IsOkAndHolds(expected_public_key));
+  EXPECT_THAT(configs->DebugString(), HasSubstr("AES-128-GCM"));
+  EXPECT_THAT(configs->DebugString(), HasSubstr("31e1f05a7401"));
 }
 
 TEST(ObliviousHttpKeyConfigs, DuplicateKeyId) {
   std::string key;
   ASSERT_TRUE(absl::HexStringToBytes(
-      "4b0020f83e0a17cbdb18d2684dd2a9b087a43e5f3fa3fa27a049bc746a6e97a1e0244b00"
-      "0400010002"  // Intentional concatenation
-      "4b0020f83e0a17cbdb18d2684dd2a9b087a43e5f3fa3fb27a049bc746a6e97a1e0244b00"
-      "0400010001",
+      // First key config.
+      "4b"                                // key_id
+      "0020"                              // kem_id
+      "606162636465666768696a6b6c6d6e6f"  // public_key
+      "707172737475767778797a7b7c7d7e7f"  // public_key
+      "0004"                              // len(symmetric_algorithms)
+      "00010002"                          // HKDF_SHA256, AES_256_GCM
+      // Second key config.
+      "4b"                                // key_id
+      "0020"                              // kem_id
+      "606162636465666768696a6b6c6d6e6f"  // public_key
+      "707172737475767778797a7b7c7d7e7f"  // public_key
+      "0004"                              // len(symmetric_algorithms)
+      "00010001",                         // HKDF_SHA256, AES_128_GCM
       &key));
   EXPECT_FALSE(ObliviousHttpKeyConfigs::ParseConcatenatedKeys(key).ok());
 }
@@ -261,22 +284,20 @@
   auto instance = ObliviousHttpHeaderKeyConfig::Create(
       123, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_CHACHA20_POLY1305);
-  ASSERT_TRUE(instance.ok());
+  QUICHE_ASSERT_OK(instance);
   EXPECT_THAT(instance->DebugString(), HasSubstr("CHACHA20-POLY1305"));
   std::string test_public_key(
       EVP_HPKE_KEM_public_key_len(instance->GetHpkeKem()), 'a');
-  auto configs =
-      ObliviousHttpKeyConfigs::Create(instance.value(), test_public_key);
-  EXPECT_TRUE(configs.ok());
+  auto configs = ObliviousHttpKeyConfigs::Create(*instance, test_public_key);
+  QUICHE_ASSERT_OK(configs);
   auto serialized_key = configs->GenerateConcatenatedKeys();
-  EXPECT_TRUE(serialized_key.ok());
+  QUICHE_ASSERT_OK(serialized_key);
   auto ohttp_configs =
-      ObliviousHttpKeyConfigs::ParseConcatenatedKeys(serialized_key.value());
-  EXPECT_TRUE(ohttp_configs.ok());
-  ASSERT_EQ(ohttp_configs->PreferredConfig().GetKeyId(), 123);
+      ObliviousHttpKeyConfigs::ParseConcatenatedKeys(*serialized_key);
+  QUICHE_ASSERT_OK(ohttp_configs);
+  EXPECT_EQ(ohttp_configs->PreferredConfig().GetKeyId(), 123);
   auto parsed_public_key = ohttp_configs->GetPublicKeyForId(123);
-  EXPECT_TRUE(parsed_public_key.ok());
-  EXPECT_EQ(parsed_public_key.value(), test_public_key);
+  EXPECT_THAT(parsed_public_key, IsOkAndHolds(test_public_key));
 }
 
 TEST(ObliviousHttpHeaderKeyConfigs, TestCreateWithWithMultipleKeys) {
@@ -294,47 +315,39 @@
       {{EVP_HPKE_HKDF_SHA256, EVP_HPKE_CHACHA20_POLY1305}}};
   EXPECT_THAT(config2.DebugString(), HasSubstr("CHACHA20-POLY1305"));
   auto configs = ObliviousHttpKeyConfigs::Create({config1, config2});
-  ASSERT_TRUE(configs.ok());
+  QUICHE_ASSERT_OK(configs);
   EXPECT_THAT(configs->DebugString(), HasSubstr("CHACHA20-POLY1305"));
   auto serialized_key = configs->GenerateConcatenatedKeys();
-  EXPECT_TRUE(serialized_key.ok());
-  ASSERT_EQ(serialized_key.value(),
-            absl::StrCat(GetSerializedKeyConfig(config2),
-                         GetSerializedKeyConfig(config1)));
+  ASSERT_THAT(serialized_key,
+              IsOkAndHolds(absl::StrCat(GetSerializedKeyConfig(config2),
+                                        GetSerializedKeyConfig(config1))));
   auto ohttp_configs =
-      ObliviousHttpKeyConfigs::ParseConcatenatedKeys(serialized_key.value());
-  ASSERT_TRUE(ohttp_configs.ok());
+      ObliviousHttpKeyConfigs::ParseConcatenatedKeys(*serialized_key);
+  QUICHE_ASSERT_OK(ohttp_configs);
   EXPECT_THAT(ohttp_configs->DebugString(), HasSubstr("CHACHA20-POLY1305"));
   ASSERT_EQ(ohttp_configs->NumKeys(), 2);
   EXPECT_THAT(configs->PreferredConfig(),
               AllOf(HasKeyId(200), HasKemId(EVP_HPKE_DHKEM_X25519_HKDF_SHA256),
                     HasKdfId(EVP_HPKE_HKDF_SHA256),
                     HasAeadId(EVP_HPKE_CHACHA20_POLY1305)));
-  auto parsed_preferred_public_key = ohttp_configs->GetPublicKeyForId(
-      ohttp_configs->PreferredConfig().GetKeyId());
-  EXPECT_TRUE(parsed_preferred_public_key.ok());
-  EXPECT_EQ(parsed_preferred_public_key.value(), expected_preferred_public_key);
+  EXPECT_THAT(ohttp_configs->GetPublicKeyForId(
+                  ohttp_configs->PreferredConfig().GetKeyId()),
+              IsOkAndHolds(expected_preferred_public_key));
 }
 
 TEST(ObliviousHttpHeaderKeyConfigs, TestCreateWithInvalidConfigs) {
-  ASSERT_EQ(ObliviousHttpKeyConfigs::Create({}).status().code(),
-            absl::StatusCode::kInvalidArgument);
-  ASSERT_EQ(ObliviousHttpKeyConfigs::Create(
-                {{100, 2, std::string(32, 'a'), {{2, 3}, {4, 5}}},
-                 {200, 6, std::string(32, 'b'), {{7, 8}, {9, 10}}}})
-                .status()
-                .code(),
-            absl::StatusCode::kInvalidArgument);
-
-  EXPECT_EQ(
-      ObliviousHttpKeyConfigs::Create(
-          {{123,
-            EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
-            "invalid key length" /*expected length for given kem_id is 32*/,
-            {{EVP_HPKE_HKDF_SHA256, EVP_HPKE_AES_128_GCM}}}})
-          .status()
-          .code(),
-      absl::StatusCode::kInvalidArgument);
+  EXPECT_FALSE(ObliviousHttpKeyConfigs::Create({}).ok());
+  EXPECT_FALSE(ObliviousHttpKeyConfigs::Create(
+                   {{100, 2, std::string(32, 'a'), {{2, 3}, {4, 5}}},
+                    {200, 6, std::string(32, 'b'), {{7, 8}, {9, 10}}}})
+                   .ok());
+  EXPECT_FALSE(ObliviousHttpKeyConfigs::Create(
+                   {{123,
+                     EVP_HPKE_DHKEM_X25519_HKDF_SHA256,
+                     // The expected length for this KEM is 32.
+                     "invalid key length",
+                     {{EVP_HPKE_HKDF_SHA256, EVP_HPKE_AES_128_GCM}}}})
+                   .ok());
 }
 
 TEST(ObliviousHttpHeaderKeyConfigs,
@@ -342,19 +355,16 @@
   const auto sample_ohttp_hdr_config = ObliviousHttpHeaderKeyConfig::Create(
       123, EVP_HPKE_DHKEM_X25519_HKDF_SHA256, EVP_HPKE_HKDF_SHA256,
       EVP_HPKE_AES_128_GCM);
-  ASSERT_TRUE(sample_ohttp_hdr_config.ok());
+  QUICHE_ASSERT_OK(sample_ohttp_hdr_config);
   EXPECT_THAT(sample_ohttp_hdr_config->DebugString(), HasSubstr("AES-128-GCM"));
-  ASSERT_EQ(ObliviousHttpKeyConfigs::Create(sample_ohttp_hdr_config.value(),
-                                            "" /*empty public_key*/)
-                .status()
-                .code(),
-            absl::StatusCode::kInvalidArgument);
-  EXPECT_EQ(ObliviousHttpKeyConfigs::Create(
-                sample_ohttp_hdr_config.value(),
-                "invalid key length" /*expected length for given kem_id is 32*/)
-                .status()
-                .code(),
-            absl::StatusCode::kInvalidArgument);
+  EXPECT_FALSE(ObliviousHttpKeyConfigs::Create(*sample_ohttp_hdr_config,
+                                               /*public_key=*/"")
+                   .ok());
+  EXPECT_FALSE(
+      ObliviousHttpKeyConfigs::Create(*sample_ohttp_hdr_config,
+                                      // The expected length for this KEM is 32.
+                                      "invalid key length")
+          .ok());
 }
 
 TEST(ObliviousHttpHeaderKeyConfigs, TestHashImplWithObliviousStruct) {