go.step.sm/crypto v0.89.0: x25519

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/go.step.sm/crypto@v0.89.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/crypto@v0.89.0
Demonstrate these symbols/APIs:
  - go.step.sm/crypto/x25519

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:46374afb5062fb05ad09128b25269857cb91d6643a43c31ea96393068fc13f2c","contract":["x25519.GenerateKey generates valid 32-byte public and private keys","PrivateKey.PublicKey derives the matching 32-byte public key from the private key","PrivateKey.SharedKey computes identical Diffie-Hellman shared secret between two key pairs","x25519.Sign produces a 64-byte signature that x25519.Verify successfully validates","x25519.Verify rejects signatures with tampered message content or corrupted signature bytes","PrivateKey.Sign rejects hashed messages by requiring crypto.Hash(0) in signer options","PublicKey.ToEd25519 converts an X25519 public key to a valid 32-byte Ed25519 public key","PublicKey.Equal and PrivateKey.Equal correctly report equality for identical keys and inequality for distinct keys"],"goal":"verify pkg:golang/go.step.sm/crypto@v0.89.0","kind":"HOW","packages":["pkg:golang/go.step.sm/crypto@v0.89.0"],"schemaVersion":1,"symbols":["go.step.sm/crypto/x25519"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/crypto@v0.89.0"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/crypto@v0.89.0","symbols":["go.step.sm/crypto/x25519"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require go.step.sm/crypto v0.89.0

require (
	filippo.io/edwards25519 v1.2.0 // indirect
	golang.org/x/crypto v0.54.0 // indirect
)

filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
go.step.sm/crypto v0.89.0 h1:NPxryE+cZ4XDwXOQY2U6Gu+mOzOihuRLPIsX7WtPzZM=
go.step.sm/crypto v0.89.0/go.mod h1:IEgE6DndnYojbDyHU7eYXpwWzpu4ftkouw7nyI6jsxg=
golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=

package main

import (
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"log"

	"go.step.sm/crypto/x25519"
)

func main() {
	alicePub, alicePriv, err := x25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("failed to generate key pair for Alice: %v", err)
	}
	fmt.Printf("Alice public key: %s\n", hex.EncodeToString(alicePub))

	bobPub, bobPriv, err := x25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("failed to generate key pair for Bob: %v", err)
	}
	fmt.Printf("Bob public key: %s\n", hex.EncodeToString(bobPub))

	aliceSecret, err := alicePriv.SharedKey(bobPub)
	if err != nil {
		log.Fatalf("Alice failed to compute shared key: %v", err)
	}
	bobSecret, err := bobPriv.SharedKey(alicePub)
	if err != nil {
		log.Fatalf("Bob failed to compute shared key: %v", err)
	}
	fmt.Printf("Shared secret established: %t\n", hex.EncodeToString(aliceSecret) == hex.EncodeToString(bobSecret))

	message := []byte("example message for XEdDSA signing")
	signature, err := x25519.Sign(rand.Reader, alicePriv, message)
	if err != nil {
		log.Fatalf("failed to sign message: %v", err)
	}
	valid := x25519.Verify(alicePub, message, signature)
	fmt.Printf("Signature verified: %t\n", valid)
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/go.step.sm/crypto@v0.89.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/crypto@v0.89.0"
  ],
  "symbols": [
    "go.step.sm/crypto/x25519"
  ]
}

package main

import (
	"bytes"
	"crypto"
	"crypto/rand"
	"fmt"
	"os"

	"go.step.sm/crypto/x25519"
)

func main() {
	if err := runContract(); err != nil {
		fmt.Fprintf(os.Stderr, "Contract verification failed: %v\n", err)
		os.Exit(1)
	}
	fmt.Println("All contract assertions passed.")
}

func runContract() error {
	// Assertion 1: x25519.GenerateKey generates valid 32-byte public and private keys
	pub1, priv1, err := x25519.GenerateKey(rand.Reader)
	if err != nil {
		return fmt.Errorf("GenerateKey failed: %w", err)
	}
	if len(pub1) != x25519.PublicKeySize {
		return fmt.Errorf("public key length mismatch: got %d, want %d", len(pub1), x25519.PublicKeySize)
	}
	if len(priv1) != x25519.PrivateKeySize {
		return fmt.Errorf("private key length mismatch: got %d, want %d", len(priv1), x25519.PrivateKeySize)
	}

	// Assertion 2: PrivateKey.PublicKey derives the matching 32-byte public key from the private key
	derivedPub, err := priv1.PublicKey()
	if err != nil {
		return fmt.Errorf("priv1.PublicKey() failed: %w", err)
	}
	if len(derivedPub) != x25519.PublicKeySize {
		return fmt.Errorf("derived public key length mismatch: got %d, want %d", len(derivedPub), x25519.PublicKeySize)
	}
	if !bytes.Equal(pub1, derivedPub) {
		return fmt.Errorf("derived public key does not match generated public key")
	}

	// Assertion 3: PrivateKey.SharedKey computes identical Diffie-Hellman shared secret between two key pairs
	pub2, priv2, err := x25519.GenerateKey(rand.Reader)
	if err != nil {
		return fmt.Errorf("second GenerateKey failed: %w", err)
	}
	secret1, err := priv1.SharedKey(pub2)
	if err != nil {
		return fmt.Errorf("priv1.SharedKey(pub2) failed: %w", err)
	}
	secret2, err := priv2.SharedKey(pub1)
	if err != nil {
		return fmt.Errorf("priv2.SharedKey(pub1) failed: %w", err)
	}
	if len(secret1) != 32 {
		return fmt.Errorf("shared secret length is %d, want 32", len(secret1))
	}
	if !bytes.Equal(secret1, secret2) {
		return fmt.Errorf("shared secrets do not match between peer 1 and peer 2")
	}

	// Assertion 4: x25519.Sign produces a 64-byte signature that x25519.Verify successfully validates
	msg := []byte("verification contract test message")
	sig, err := x25519.Sign(rand.Reader, priv1, msg)
	if err != nil {
		return fmt.Errorf("Sign failed: %w", err)
	}
	if len(sig) != x25519.SignatureSize {
		return fmt.Errorf("signature length mismatch: got %d, want %d", len(sig), x25519.SignatureSize)
	}
	if !x25519.Verify(pub1, msg, sig) {
		return fmt.Errorf("Verify failed for valid signature")
	}

	// Assertion 5: x25519.Verify rejects signatures with tampered message content or corrupted signature bytes
	tamperedMsg := []byte("tampered contract test message")
	if x25519.Verify(pub1, tamperedMsg, sig) {
		return fmt.Errorf("Verify unexpectedly succeeded on tampered message")
	}
	tamperedSig := make([]byte, len(sig))
	copy(tamperedSig, sig)
	tamperedSig[0] ^= 0xff
	if x25519.Verify(pub1, msg, tamperedSig) {
		return fmt.Errorf("Verify unexpectedly succeeded on tampered signature")
	}

	// Assertion 6: PrivateKey.Sign rejects hashed messages by requiring crypto.Hash(0) in signer options
	if _, err := priv1.Sign(rand.Reader, msg, crypto.SHA256); err == nil {
		return fmt.Errorf("PrivateKey.Sign should return error when hashed message option is provided")
	}

	// Assertion 7: PublicKey.ToEd25519 converts an X25519 public key to a valid 32-byte Ed25519 public key
	edPub, err := pub1.ToEd25519()
	if err != nil {
		return fmt.Errorf("ToEd25519 failed: %w", err)
	}
	if len(edPub) != 32 {
		return fmt.Errorf("ed25519 public key size mismatch: got %d, want 32", len(edPub))
	}

	// Assertion 8: PublicKey.Equal and PrivateKey.Equal correctly report equality for identical keys and inequality for distinct keys
	if !pub1.Equal(derivedPub) {
		return fmt.Errorf("pub1.Equal(derivedPub) should be true")
	}
	if pub1.Equal(pub2) {
		return fmt.Errorf("pub1.Equal(pub2) should be false")
	}
	if !priv1.Equal(priv1) {
		return fmt.Errorf("priv1.Equal(priv1) should be true")
	}
	if priv1.Equal(priv2) {
		return fmt.Errorf("priv1.Equal(priv2) should be false")
	}

	return nil
}