go.step.sm/crypto v0.45.0: keyutil.GenerateKeyPair

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify go.step.sm/crypto/keyutil.GenerateKeyPair in pkg:golang/go.step.sm/crypto@v0.45.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.45.0
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/keyutil.GenerateKeyPair
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:1160d64b732919c2440655eb653dda882fb9086dcc1d42be3e84c867cbddeace","contract":["keyutil.GenerateKeyPair(\"EC\", \"P-256\", 0) returns non-nil ECDSA public and private keys matching elliptic curve P-256","keyutil.GenerateKeyPair(\"RSA\", \"\", 2048) returns non-nil RSA key pair with at least 2048 bit modulus","keyutil.GenerateKeyPair(\"OKP\", \"Ed25519\", 0) returns non-nil Ed25519 public and private keys","keyutil.VerifyPair returns nil when verifying matching generated key pairs for EC, RSA, and OKP","keyutil.Fingerprint returns a non-empty string fingerprint for generated public keys","keyutil.GenerateKeyPair returns an error when given an unsupported key algorithm","keyutil.VerifyPair returns an error when verifying mismatched public and private keys"],"goal":"verify go.step.sm/crypto/keyutil.GenerateKeyPair in pkg:golang/go.step.sm/crypto@v0.45.0","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.45.0"],"schemaVersion":1,"symbols":["go.step.sm/crypto/keyutil.GenerateKeyPair"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.45.0"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.45.0","symbols":["go.step.sm/crypto/keyutil.GenerateKeyPair"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require go.step.sm/crypto v0.45.0

require (
	filippo.io/edwards25519 v1.1.0 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	golang.org/x/crypto v0.23.0 // indirect
	golang.org/x/sys v0.20.0 // indirect
)

filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262/go.mod h1:MyOHs9Po2fbM1LHej6sBUT8ozbxmMOFG+E+rx/GSGuc=
go.step.sm/crypto v0.45.0 h1:Z0WYAaaOYrJmKP9sJkPW+6wy3pgN3Ija8ek/D4serjc=
go.step.sm/crypto v0.45.0/go.mod h1:6IYlT0L2jfj81nVyCPpvA5cORy0EVHPhieSgQyuwHIY=
golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=

package main

import (
	"fmt"
	"log"

	"go.step.sm/crypto/keyutil"
)

func main() {
	// Generate an ECDSA P-256 key pair
	pub, priv, err := keyutil.GenerateKeyPair("EC", "P-256", 0)
	if err != nil {
		log.Fatalf("failed to generate EC key pair: %v", err)
	}

	// Verify that the generated public and private keys match
	if err := keyutil.VerifyPair(pub, priv); err != nil {
		log.Fatalf("key pair verification failed: %v", err)
	}

	// Calculate the public key fingerprint
	fp, err := keyutil.Fingerprint(pub)
	if err != nil {
		log.Fatalf("failed to compute fingerprint: %v", err)
	}

	fmt.Printf("Successfully generated and verified key pair. Fingerprint: %s\n", fp)
}

{
  "schemaVersion": 1,
  "goal": "verify go.step.sm/crypto/keyutil.GenerateKeyPair in pkg:golang/go.step.sm/crypto@v0.45.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.45.0"
  ],
  "symbols": [
    "go.step.sm/crypto/keyutil.GenerateKeyPair"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"crypto/ecdsa"
	"crypto/ed25519"
	"crypto/elliptic"
	"crypto/rsa"
	"fmt"
	"os"

	"go.step.sm/crypto/keyutil"
)

func main() {
	// 1. keyutil.GenerateKeyPair("EC", "P-256", 0) returns non-nil ECDSA public and private keys matching elliptic curve P-256
	pubEC, privEC, err := keyutil.GenerateKeyPair("EC", "P-256", 0)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(EC, P-256) failed: %v\n", err)
		os.Exit(1)
	}
	ecdsaPub, ok := pubEC.(*ecdsa.PublicKey)
	if !ok || ecdsaPub == nil || ecdsaPub.Curve != elliptic.P256() {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(EC, P-256) returned invalid public key: %T\n", pubEC)
		os.Exit(1)
	}
	if _, ok := privEC.(*ecdsa.PrivateKey); !ok || privEC == nil {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(EC, P-256) returned invalid private key: %T\n", privEC)
		os.Exit(1)
	}

	// 2. keyutil.GenerateKeyPair("RSA", "", 2048) returns non-nil RSA key pair with at least 2048 bit modulus
	pubRSA, privRSA, err := keyutil.GenerateKeyPair("RSA", "", 2048)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(RSA, 2048) failed: %v\n", err)
		os.Exit(1)
	}
	rsaPub, ok := pubRSA.(*rsa.PublicKey)
	if !ok || rsaPub == nil || rsaPub.N.BitLen() < 2048 {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(RSA, 2048) returned invalid public key: %T\n", pubRSA)
		os.Exit(1)
	}
	if _, ok := privRSA.(*rsa.PrivateKey); !ok || privRSA == nil {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(RSA, 2048) returned invalid private key: %T\n", privRSA)
		os.Exit(1)
	}

	// 3. keyutil.GenerateKeyPair("OKP", "Ed25519", 0) returns non-nil Ed25519 public and private keys
	pubEd, privEd, err := keyutil.GenerateKeyPair("OKP", "Ed25519", 0)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(OKP, Ed25519) failed: %v\n", err)
		os.Exit(1)
	}
	edPub, ok := pubEd.(ed25519.PublicKey)
	if !ok || len(edPub) == 0 {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(OKP, Ed25519) returned invalid public key: %T\n", pubEd)
		os.Exit(1)
	}
	edPriv, ok := privEd.(ed25519.PrivateKey)
	if !ok || len(edPriv) == 0 {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(OKP, Ed25519) returned invalid private key: %T\n", privEd)
		os.Exit(1)
	}

	// 4. keyutil.VerifyPair returns nil when verifying matching generated key pairs for EC, RSA, and OKP
	if err := keyutil.VerifyPair(pubEC, privEC); err != nil {
		fmt.Fprintf(os.Stderr, "VerifyPair(EC) failed: %v\n", err)
		os.Exit(1)
	}
	if err := keyutil.VerifyPair(pubRSA, privRSA); err != nil {
		fmt.Fprintf(os.Stderr, "VerifyPair(RSA) failed: %v\n", err)
		os.Exit(1)
	}
	if err := keyutil.VerifyPair(pubEd, privEd); err != nil {
		fmt.Fprintf(os.Stderr, "VerifyPair(Ed25519) failed: %v\n", err)
		os.Exit(1)
	}

	// 5. keyutil.Fingerprint returns a non-empty string fingerprint for generated public keys
	fpEC, err := keyutil.Fingerprint(pubEC)
	if err != nil || len(fpEC) == 0 {
		fmt.Fprintf(os.Stderr, "Fingerprint(pubEC) failed or empty: err=%v, fp=%q\n", err, fpEC)
		os.Exit(1)
	}
	fpRSA, err := keyutil.Fingerprint(pubRSA)
	if err != nil || len(fpRSA) == 0 {
		fmt.Fprintf(os.Stderr, "Fingerprint(pubRSA) failed or empty: err=%v, fp=%q\n", err, fpRSA)
		os.Exit(1)
	}
	fpEd, err := keyutil.Fingerprint(pubEd)
	if err != nil || len(fpEd) == 0 {
		fmt.Fprintf(os.Stderr, "Fingerprint(pubEd) failed or empty: err=%v, fp=%q\n", err, fpEd)
		os.Exit(1)
	}

	// 6. keyutil.GenerateKeyPair returns an error when given an unsupported key algorithm
	if _, _, err := keyutil.GenerateKeyPair("UNSUPPORTED_ALG", "", 0); err == nil {
		fmt.Fprintf(os.Stderr, "GenerateKeyPair(UNSUPPORTED_ALG) expected error, got nil\n")
		os.Exit(1)
	}

	// 7. keyutil.VerifyPair returns an error when verifying mismatched public and private keys
	if err := keyutil.VerifyPair(pubEC, privRSA); err == nil {
		fmt.Fprintf(os.Stderr, "VerifyPair with mismatched EC public and RSA private key expected error, got nil\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}