diff --git a/presence/implementation/ldt.cc b/presence/implementation/ldt.cc
index 3491cac3..b37a53f9 100644
--- a/presence/implementation/ldt.cc
+++ b/presence/implementation/ldt.cc
@@ -33,7 +33,7 @@ namespace presence {
 
 namespace {
 // NP LDT library says that 0 is returned when `NpLdtCreate()` fails.
-constexpr NpLdtHandle kInvalidLdtHandle = static_cast<NpLdtHandle>(0);
+constexpr uint64_t kInvalidLdtHandle = 0;
 
 template <class T>
 T FromStringView(absl::string_view data) {
@@ -47,33 +47,44 @@ T FromStringView(absl::string_view data) {
 }  // namespace
 
 LdtEncryptor::LdtEncryptor(LdtEncryptor&& other)
-    : ldt_handle_(other.ldt_handle_) {
-  other.ldt_handle_ = kInvalidLdtHandle;
+    : ldt_encrypt_handle_(other.ldt_encrypt_handle_),
+      ldt_decrypt_handle_(other.ldt_decrypt_handle_) {
+  other.ldt_encrypt_handle_.handle = kInvalidLdtHandle;
+  other.ldt_decrypt_handle_.handle = kInvalidLdtHandle;
 }
+
 LdtEncryptor::~LdtEncryptor() {
-  if (ldt_handle_ != kInvalidLdtHandle) {
-    NpLdtClose(ldt_handle_);
+  if (ldt_encrypt_handle_.handle != kInvalidLdtHandle) {
+    NpLdtEncryptClose(ldt_encrypt_handle_);
+  }
+  if (ldt_decrypt_handle_.handle != kInvalidLdtHandle) {
+    NpLdtDecryptClose(ldt_decrypt_handle_);
   }
 }
 
 absl::StatusOr<LdtEncryptor> LdtEncryptor::Create(
     absl::string_view key_seed, absl::string_view known_hmac) {
-  NpLdtHandle handle =
-      NpLdtCreate(FromStringView<NpLdtKeySeed>(key_seed),
-                  FromStringView<NpMetadataKeyHmac>(known_hmac));
-  if (handle == kInvalidLdtHandle) {
+  NpLdtEncryptHandle encrypt_handle =
+      NpLdtEncryptCreate(FromStringView<NpLdtKeySeed>(key_seed));
+  NpLdtDecryptHandle decrypt_handle =
+      NpLdtDecryptCreate(FromStringView<NpLdtKeySeed>(key_seed),
+                         FromStringView<NpMetadataKeyHmac>(known_hmac));
+  if (encrypt_handle.handle == kInvalidLdtHandle) {
     return absl::UnavailableError("Failed to create LDT encryptor");
   }
+  if (decrypt_handle.handle == kInvalidLdtHandle) {
+    return absl::UnavailableError("Failed to create LDT decrypter");
+  }
 
-  return LdtEncryptor(handle);
+  return LdtEncryptor(encrypt_handle, decrypt_handle);
 }
 
 absl::StatusOr<std::string> LdtEncryptor::Encrypt(absl::string_view data,
                                                   absl::string_view salt) {
   std::string encrypted = std::string(data);
-  NP_LDT_RESULT result =
-      NpLdtEncrypt(ldt_handle_, reinterpret_cast<uint8_t*>(encrypted.data()),
-                   encrypted.size(), FromStringView<NpLdtSalt>(salt));
+  NP_LDT_RESULT result = NpLdtEncrypt(
+      ldt_encrypt_handle_, reinterpret_cast<uint8_t*>(encrypted.data()),
+      encrypted.size(), FromStringView<NpLdtSalt>(salt));
   if (result == NP_LDT_SUCCESS) {
     return encrypted;
   }
@@ -85,7 +96,7 @@ absl::StatusOr<std::string> LdtEncryptor::DecryptAndVerify(
     absl::string_view data, absl::string_view salt) {
   std::string encrypted = std::string(data);
   NP_LDT_RESULT result = NpLdtDecryptAndVerify(
-      ldt_handle_, reinterpret_cast<uint8_t*>(encrypted.data()),
+      ldt_decrypt_handle_, reinterpret_cast<uint8_t*>(encrypted.data()),
       encrypted.size(), FromStringView<NpLdtSalt>(salt));
   if (result == NP_LDT_SUCCESS) {
     return encrypted;
diff --git a/presence/implementation/ldt.h b/presence/implementation/ldt.h
index 54ab084f..429d603c 100644
--- a/presence/implementation/ldt.h
+++ b/presence/implementation/ldt.h
@@ -36,7 +36,8 @@ class LdtEncryptor {
   LdtEncryptor(LdtEncryptor&& other);
   LdtEncryptor& operator=(const LdtEncryptor&) = delete;
   LdtEncryptor& operator=(LdtEncryptor&& other) {
-    std::swap(ldt_handle_, other.ldt_handle_);
+    std::swap(ldt_encrypt_handle_, other.ldt_encrypt_handle_);
+    std::swap(ldt_decrypt_handle_, other.ldt_decrypt_handle_);
     return *this;
   }
   ~LdtEncryptor();
@@ -58,10 +59,14 @@ class LdtEncryptor {
                                                absl::string_view salt);
 
  private:
-  explicit LdtEncryptor(NpLdtHandle ldt_handle) : ldt_handle_(ldt_handle) {}
+  explicit LdtEncryptor(NpLdtEncryptHandle ldt_encrypt_handle,
+                        NpLdtDecryptHandle ldt_decrypt_handle)
+      : ldt_encrypt_handle_(ldt_encrypt_handle),
+        ldt_decrypt_handle_(ldt_decrypt_handle) {}
   // An opaque handle to the underlying LDT implementation. It can be null iff
   // this object has already been destroyed.
-  NpLdtHandle ldt_handle_;
+  NpLdtEncryptHandle ldt_encrypt_handle_;
+  NpLdtDecryptHandle ldt_decrypt_handle_;
 };
 
 }  // namespace presence
diff --git a/presence/implementation/np_ldt.c b/presence/implementation/np_ldt.c
index b0210b9b..ec36e5b7 100644
--- a/presence/implementation/np_ldt.c
+++ b/presence/implementation/np_ldt.c
@@ -17,18 +17,26 @@
 // Placeholder, empty implementations of LDT utilities. They will be replaced
 // with implementations in Rust.
 
-NpLdtHandle NpLdtCreate(NpLdtKeySeed key_seed, NpMetadataKeyHmac known_hmac) {
-  return 0;
+NpLdtEncryptHandle NpLdtEncryptCreate(NpLdtKeySeed key_seed) {
+  NpLdtEncryptHandle handle = {0};
+  return handle;
 }
 
-NP_LDT_RESULT NpLdtClose(NpLdtHandle handle) { return NP_LDT_SUCCESS; }
+NpLdtDecryptHandle NpLdtDecryptCreate(NpLdtKeySeed key_seed, NpMetadataKeyHmac hmac_tag) {
+  NpLdtDecryptHandle handle = {0};
+  return handle;
+}
 
-NP_LDT_RESULT NpLdtEncrypt(NpLdtHandle handle, uint8_t* buffer,
+NP_LDT_RESULT NpLdtEncryptClose(NpLdtEncryptHandle handle) { return NP_LDT_SUCCESS; }
+
+NP_LDT_RESULT NpLdtDecryptClose(NpLdtDecryptHandle handle) { return NP_LDT_SUCCESS; }
+
+NP_LDT_RESULT NpLdtEncrypt(NpLdtEncryptHandle handle, uint8_t* buffer,
                            size_t buffer_len, NpLdtSalt salt) {
   return NP_LDT_SUCCESS;
 }
 
-NP_LDT_RESULT NpLdtDecryptAndVerify(NpLdtHandle handle, uint8_t* buffer,
+NP_LDT_RESULT NpLdtDecryptAndVerify(NpLdtDecryptHandle handle, uint8_t* buffer,
                                     size_t buffer_len, NpLdtSalt salt) {
   return NP_LDT_SUCCESS;
 }
diff --git a/presence/implementation/np_ldt.h b/presence/implementation/np_ldt.h
index 14ef5f56..7af6d143 100644
--- a/presence/implementation/np_ldt.h
+++ b/presence/implementation/np_ldt.h
@@ -32,8 +32,15 @@ extern "C" {
 // Individual encrypt/decrypt API, useful when creating advertisements or when
 // decrypting advertisements from a known origin
 
-// Handle for accessing the rust ldt implementation apis
-typedef uint64_t NpLdtHandle;
+// The allocated handle to use for encryption
+typedef struct {
+  uint64_t handle;
+} NpLdtEncryptHandle;
+
+// The allocated handle to use for decryption
+typedef struct {
+  uint64_t handle;
+} NpLdtDecryptHandle;
 
 // Key material from the Nearby Presence credential from which keys will be
 // derived.
@@ -60,20 +67,34 @@ typedef enum {
   NP_LDT_ERROR_MAC_MISMATCH = -2,
 } NP_LDT_RESULT;
 
-// Allocate an LDT-XTS-AES128 cipher using the "swap" mix function.
+// Allocate an LDT-XTS-AES128 Decryption cipher using the "swap" mix function.
+//
+// `key_seed` is the key material from the Nearby Presence credential from which
+// the LDT key will be derived.
+// 'hmac_tag' is the hmac auth tag calculated on the metadata key used to verify
+// decryption was successful
+//
+// Returns 0 on error, or a non-zero handle on success.
+NpLdtDecryptHandle NpLdtDecryptCreate(NpLdtKeySeed key_seed,
+                                      NpMetadataKeyHmac hmac_tag);
+
+// Allocate an LDT-XTS-AES128 Encryption cipher using the "swap" mix function.
 //
-// `aes_config` defines the AES impl that will be used.
 // `key_seed` is the key material from the Nearby Presence credential from which
 // the LDT key will be derived.
 //
 // Returns 0 on error, or a non-zero handle on success.
-NpLdtHandle NpLdtCreate(NpLdtKeySeed key_seed, NpMetadataKeyHmac known_hmac);
+NpLdtEncryptHandle NpLdtEncryptCreate(NpLdtKeySeed key_seed);
 
-// Release resources for an NpLdtHandle allocated by
-// `np_ldt_create_xts_aes_128`.
+// Release allocated resources for an NpLdtEncryptHandle
 //
 // Returns 0 on success or an NP_LDT_RESULT error code on failure
-NP_LDT_RESULT NpLdtClose(NpLdtHandle handle);
+NP_LDT_RESULT NpLdtEncryptClose(NpLdtEncryptHandle handle);
+
+// Release allocated resources for an NpLdtDecryptHandle
+//
+// Returns 0 on success or an NP_LDT_RESULT error code on failure
+NP_LDT_RESULT NpLdtDecryptClose(NpLdtDecryptHandle handle);
 
 // Encrypt a 16-31 byte buffer in-place.
 //
@@ -84,7 +105,7 @@ NP_LDT_RESULT NpLdtClose(NpLdtHandle handle);
 //
 // Returns 0 on success, in which case `buffer` will now contain ciphertext.
 // Returns an NP_LDT_RESULT error code on failure
-NP_LDT_RESULT NpLdtEncrypt(NpLdtHandle handle, uint8_t* buffer,
+NP_LDT_RESULT NpLdtEncrypt(NpLdtEncryptHandle handle, uint8_t* buffer,
                            size_t buffer_len, NpLdtSalt salt);
 
 // Decrypt a 16-31 byte buffer in-place.
@@ -97,7 +118,7 @@ NP_LDT_RESULT NpLdtEncrypt(NpLdtHandle handle, uint8_t* buffer,
 //
 // Returns 0 on success, in which case `buffer` will now contain plaintext.
 // Returns an NP_LDT_RESULT error code on failure
-NP_LDT_RESULT NpLdtDecryptAndVerify(NpLdtHandle handle, uint8_t* buffer,
+NP_LDT_RESULT NpLdtDecryptAndVerify(NpLdtDecryptHandle handle, uint8_t* buffer,
                                     size_t buffer_len, NpLdtSalt salt);
 
 #ifdef __cplusplus