golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9: blake2b.New256

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify blake2b.New256 in pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
Demonstrate these symbols/APIs:
  - blake2b.New256

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:df9fbbe30cddbb0e3ffc4d39a85ca6fe3971288135e286aba942df33f216d70c","contract":["blake2b.New256 returns nil error and hash with Size 32 when key is nil","blake2b.New256 returns nil error and hash with Size 32 when key is empty byte slice","blake2b.New256 returns nil error for valid key lengths between 1 and 64 bytes","blake2b.New256 returns error with invalid key size when key exceeds 64 bytes","blake2b.New256 unkeyed digest matches Sum256 for identical input data","blake2b.New256 MAC digest differs when computing with distinct keys","blake2b.New256 Reset restores state to produce reproducible hash digests"],"goal":"verify blake2b.New256 in pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9"],"schemaVersion":1,"symbols":["blake2b.New256"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9","symbols":["blake2b.New256"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.23

require golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9

require golang.org/x/sys v0.0.0-20190412213103-97732733099d // indirect

golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d h1:+R4KGOnez64A81RvjARKc4UT5/tI9ujCIVX+P5KiHuI=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

package main

import (
	"bytes"
	"encoding/hex"
	"fmt"
	"log"

	"golang.org/x/crypto/blake2b"
)

func main() {
	// 1. Unkeyed BLAKE2b-256 hash
	hasher, err := blake2b.New256(nil)
	if err != nil {
		log.Fatalf("failed to create blake2b-256 hasher: %v", err)
	}

	message := []byte("example payload for hashing")
	hasher.Write(message)
	digest := hasher.Sum(nil)
	fmt.Printf("BLAKE2b-256 digest: %s\n", hex.EncodeToString(digest))

	// Verify unkeyed result matches direct Sum256
	directSum := blake2b.Sum256(message)
	if !bytes.Equal(digest, directSum[:]) {
		log.Fatalf("digest mismatch with Sum256")
	}

	// 2. Keyed BLAKE2b-256 MAC (up to 64 bytes key)
	key := []byte("example-secret-key-32-bytes-long!")
	macHasher, err := blake2b.New256(key)
	if err != nil {
		log.Fatalf("failed to create keyed blake2b-256: %v", err)
	}
	macHasher.Write(message)
	macDigest := macHasher.Sum(nil)
	fmt.Printf("Keyed BLAKE2b-256 MAC: %s\n", hex.EncodeToString(macDigest))

	// 3. Invalid key size check (> 64 bytes)
	invalidKey := make([]byte, 65)
	_, err = blake2b.New256(invalidKey)
	if err != nil {
		fmt.Printf("Expected error for oversized key: %v\n", err)
	}
}

{
  "schemaVersion": 1,
  "goal": "verify blake2b.New256 in pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9"
  ],
  "symbols": [
    "blake2b.New256"
  ]
}

package main

import (
	"bytes"
	"fmt"
	"os"

	"golang.org/x/crypto/blake2b"
)

func main() {
	// 1. blake2b.New256 returns nil error and hash with Size 32 when key is nil
	h1, err := blake2b.New256(nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: expected nil error, got %v\n", err)
		os.Exit(1)
	}
	if h1.Size() != 32 {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: expected size 32, got %d\n", h1.Size())
		os.Exit(1)
	}
	if h1.BlockSize() != 128 {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: expected block size 128, got %d\n", h1.BlockSize())
		os.Exit(1)
	}

	// 2. blake2b.New256 returns nil error and hash with Size 32 when key is empty byte slice
	h2, err := blake2b.New256([]byte{})
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 2 failed: expected nil error, got %v\n", err)
		os.Exit(1)
	}
	if h2.Size() != 32 {
		fmt.Fprintf(os.Stderr, "assertion 2 failed: expected size 32, got %d\n", h2.Size())
		os.Exit(1)
	}

	// 3. blake2b.New256 returns nil error for valid key lengths between 1 and 64 bytes
	for kLen := 1; kLen <= 64; kLen++ {
		testKey := make([]byte, kLen)
		testKey[0] = byte(kLen)
		hKey, err := blake2b.New256(testKey)
		if err != nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed for key len %d: %v\n", kLen, err)
			os.Exit(1)
		}
		if hKey == nil {
			fmt.Fprintf(os.Stderr, "assertion 3 failed for key len %d: hasher is nil\n", kLen)
			os.Exit(1)
		}
	}

	// 4. blake2b.New256 returns error with invalid key size when key exceeds 64 bytes
	tooLongKey := make([]byte, 65)
	_, err = blake2b.New256(tooLongKey)
	if err == nil {
		fmt.Fprintf(os.Stderr, "assertion 4 failed: expected error for 65-byte key, got nil\n")
		os.Exit(1)
	}
	if err.Error() != "blake2b: invalid key size" {
		fmt.Fprintf(os.Stderr, "assertion 4 failed: unexpected error message: %v\n", err)
		os.Exit(1)
	}

	// 5. blake2b.New256 unkeyed digest matches Sum256 for identical input data
	data := []byte("contract-verification-payload")
	hUnkeyed, err := blake2b.New256(nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 5 setup failed: %v\n", err)
		os.Exit(1)
	}
	hUnkeyed.Write(data)
	digest1 := hUnkeyed.Sum(nil)
	directSum := blake2b.Sum256(data)
	if !bytes.Equal(digest1, directSum[:]) {
		fmt.Fprintf(os.Stderr, "assertion 5 failed: digest mismatch with Sum256\n")
		os.Exit(1)
	}

	// 6. blake2b.New256 MAC digest differs when computing with distinct keys
	keyA := []byte("key-variant-alpha-0123456789")
	keyB := []byte("key-variant-beta--0123456789")
	hA, err := blake2b.New256(keyA)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 6 setup A failed: %v\n", err)
		os.Exit(1)
	}
	hB, err := blake2b.New256(keyB)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 6 setup B failed: %v\n", err)
		os.Exit(1)
	}
	hA.Write(data)
	hB.Write(data)
	digestA := hA.Sum(nil)
	digestB := hB.Sum(nil)
	if bytes.Equal(digestA, digestB) {
		fmt.Fprintf(os.Stderr, "assertion 6 failed: MAC digests should differ for distinct keys\n")
		os.Exit(1)
	}

	// 7. blake2b.New256 Reset restores state to produce reproducible hash digests
	hReset, err := blake2b.New256(nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "assertion 7 setup failed: %v\n", err)
		os.Exit(1)
	}
	hReset.Write(data)
	firstDigest := hReset.Sum(nil)

	hReset.Reset()
	hReset.Write(data)
	secondDigest := hReset.Sum(nil)
	if !bytes.Equal(firstDigest, secondDigest) {
		fmt.Fprintf(os.Stderr, "assertion 7 failed: digest after Reset did not match initial digest\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}