golang.org/x/crypto v0.20.0: hkdf.Expand

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hkdf.Expand in pkg:golang/golang.org/x/crypto@v0.20.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.20.0
Demonstrate these symbols/APIs:
  - hkdf.Expand
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:b46b9fbf6ddcdf3b4627526d91a55fc0fabc47f92e697d6ebde5825edc0011dd","contract":["hkdf.Expand returns an io.Reader expanding PRK into derived key stream with given hash and info","hkdf.Expand matches RFC 5869 test vector 1 for SHA-256 HKDF-Expand with pre-extracted PRK","hkdf.Expand produces identical key stream as hkdf.New when given extracted PRK","hkdf.Expand matches RFC 5869 test vector 2 with longer PRK and info","hkdf.Expand accepts nil info and empty byte slice info yielding identical derived output","hkdf.Expand supports multiple sequential Read calls consuming contiguous chunks of expanded key stream","hkdf.Expand with different info strings produces cryptographically distinct derived keys from the same PRK","hkdf.Expand works with different hash functions such as SHA-1, SHA-384 and SHA-512","hkdf.Expand returns error when requested read length exceeds RFC 5869 maximum expansion limit of 255 * hash.Size"],"goal":"verify hkdf.Expand in pkg:golang/golang.org/x/crypto@v0.20.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.20.0"],"schemaVersion":1,"symbols":["hkdf.Expand"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.20.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.20.0","symbols":["hkdf.Expand"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.22.0

require golang.org/x/crypto v0.20.0

golang.org/x/crypto v0.20.0 h1:jmAMJJZXr5KiCw05dfYK9QnqaqKLYXijU23lsEdcQqg=
golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=

package main

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"

	"golang.org/x/crypto/hkdf"
)

func main() {
	secret := []byte("master-secret-key-material")
	salt := []byte("salt-value-for-kdf")
	info := []byte("aes-256-gcm-encryption-key")

	prk := hkdf.Extract(sha256.New, secret, salt)
	fmt.Printf("PRK (%d bytes): %s\n", len(prk), hex.EncodeToString(prk))

	reader := hkdf.Expand(sha256.New, prk, info)

	derivedKey := make([]byte, 32)
	if _, err := io.ReadFull(reader, derivedKey); err != nil {
		panic(err)
	}
	fmt.Printf("Derived Key (32 bytes): %s\n", hex.EncodeToString(derivedKey))

	derivedIV := make([]byte, 12)
	if _, err := io.ReadFull(reader, derivedIV); err != nil {
		panic(err)
	}
	fmt.Printf("Derived IV (12 bytes): %s\n", hex.EncodeToString(derivedIV))
}

{
  "schemaVersion": 1,
  "goal": "verify hkdf.Expand in pkg:golang/golang.org/x/crypto@v0.20.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.20.0"
  ],
  "symbols": [
    "hkdf.Expand"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"crypto/sha1"
	"crypto/sha256"
	"crypto/sha512"
	"fmt"
	"io"
	"os"

	"golang.org/x/crypto/hkdf"
)

func main() {
	// 1. hkdf.Expand returns an io.Reader expanding PRK into derived key stream with given hash and info
	prk1 := []byte{
		0x07, 0x77, 0x09, 0x36, 0x2c, 0x2e, 0x32, 0xdf,
		0x0d, 0xdc, 0x3f, 0x0d, 0xc4, 0x7b, 0xba, 0x63,
		0x90, 0xb6, 0xc7, 0x3b, 0xb5, 0x0f, 0x9c, 0x31,
		0x22, 0xec, 0x84, 0x4a, 0xd7, 0xc2, 0xb3, 0xe5,
	}
	info1 := []byte{
		0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
		0xf8, 0xf9,
	}
	expReader := hkdf.Expand(sha256.New, prk1, info1)
	if expReader == nil {
		fmt.Fprintf(os.Stderr, "hkdf.Expand returned nil reader\n")
		os.Exit(1)
	}
	out1 := make([]byte, 42)
	n, err := io.ReadFull(expReader, out1)
	if err != nil || n != 42 {
		fmt.Fprintf(os.Stderr, "failed to read 42 bytes from expand reader: %v (read %d)\n", err, n)
		os.Exit(1)
	}

	// 2. hkdf.Expand matches RFC 5869 test vector 1 for SHA-256 HKDF-Expand with pre-extracted PRK
	expectedOKM1 := []byte{
		0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
		0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
		0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
		0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
		0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
		0x58, 0x65,
	}
	if !bytes.Equal(out1, expectedOKM1) {
		fmt.Fprintf(os.Stderr, "RFC 5869 test vector 1 OKM mismatch: got %x, want %x\n", out1, expectedOKM1)
		os.Exit(1)
	}

	// 3. hkdf.Expand produces identical key stream as hkdf.New when given extracted PRK
	ikm1 := []byte{
		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
		0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
	}
	salt1 := []byte{
		0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
		0x08, 0x09, 0x0a, 0x0b, 0x0c,
	}
	extractedPRK := hkdf.Extract(sha256.New, ikm1, salt1)
	if !bytes.Equal(extractedPRK, prk1) {
		fmt.Fprintf(os.Stderr, "extracted PRK mismatch: got %x, want %x\n", extractedPRK, prk1)
		os.Exit(1)
	}
	newReader := hkdf.New(sha256.New, ikm1, salt1, info1)
	newOut := make([]byte, 42)
	if _, err := io.ReadFull(newReader, newOut); err != nil {
		fmt.Fprintf(os.Stderr, "failed reading from hkdf.New: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(newOut, out1) {
		fmt.Fprintf(os.Stderr, "hkdf.New output does not match hkdf.Expand output\n")
		os.Exit(1)
	}

	// 4. hkdf.Expand matches RFC 5869 test vector 2 with longer PRK and info
	prk2 := []byte{
		0x06, 0xa6, 0xb8, 0x8c, 0x58, 0x53, 0x36, 0x1a,
		0x06, 0x10, 0x4c, 0x9c, 0xeb, 0x35, 0xb4, 0x5c,
		0xef, 0x76, 0x00, 0x14, 0x90, 0x46, 0x71, 0x01,
		0x4a, 0x19, 0x3f, 0x40, 0xc1, 0x5f, 0xc2, 0x44,
	}
	info2 := []byte{
		0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
		0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
		0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
		0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf,
		0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
		0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
		0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7,
		0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
		0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
		0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
	}
	expectedOKM2 := []byte{
		0xb1, 0x1e, 0x39, 0x8d, 0xc8, 0x03, 0x27, 0xa1,
		0xc8, 0xe7, 0xf7, 0x8c, 0x59, 0x6a, 0x49, 0x34,
		0x4f, 0x01, 0x2e, 0xda, 0x2d, 0x4e, 0xfa, 0xd8,
		0xa0, 0x50, 0xcc, 0x4c, 0x19, 0xaf, 0xa9, 0x7c,
		0x59, 0x04, 0x5a, 0x99, 0xca, 0xc7, 0x82, 0x72,
		0x71, 0xcb, 0x41, 0xc6, 0x5e, 0x59, 0x0e, 0x09,
		0xda, 0x32, 0x75, 0x60, 0x0c, 0x2f, 0x09, 0xb8,
		0x36, 0x77, 0x93, 0xa9, 0xac, 0xa3, 0xdb, 0x71,
		0xcc, 0x30, 0xc5, 0x81, 0x79, 0xec, 0x3e, 0x87,
		0xc1, 0x4c, 0x01, 0xd5, 0xc1, 0xf3, 0x43, 0x4f,
		0x1d, 0x87,
	}
	r2 := hkdf.Expand(sha256.New, prk2, info2)
	out2 := make([]byte, len(expectedOKM2))
	if _, err := io.ReadFull(r2, out2); err != nil {
		fmt.Fprintf(os.Stderr, "RFC 5869 test vector 2 read failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(out2, expectedOKM2) {
		fmt.Fprintf(os.Stderr, "RFC 5869 test vector 2 OKM mismatch\n")
		os.Exit(1)
	}

	// 5. hkdf.Expand accepts nil info and empty byte slice info yielding identical derived output
	rNil := hkdf.Expand(sha256.New, prk1, nil)
	rEmpty := hkdf.Expand(sha256.New, prk1, []byte{})
	bufNil := make([]byte, 32)
	bufEmpty := make([]byte, 32)
	if _, err := io.ReadFull(rNil, bufNil); err != nil {
		fmt.Fprintf(os.Stderr, "nil info read failed: %v\n", err)
		os.Exit(1)
	}
	if _, err := io.ReadFull(rEmpty, bufEmpty); err != nil {
		fmt.Fprintf(os.Stderr, "empty info read failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(bufNil, bufEmpty) {
		fmt.Fprintf(os.Stderr, "nil info and empty info produced different outputs\n")
		os.Exit(1)
	}

	// 6. hkdf.Expand supports multiple sequential Read calls consuming contiguous chunks of expanded key stream
	rSeq := hkdf.Expand(sha256.New, prk1, info1)
	chunk1 := make([]byte, 16)
	chunk2 := make([]byte, 26)
	if _, err := io.ReadFull(rSeq, chunk1); err != nil {
		fmt.Fprintf(os.Stderr, "chunk 1 read failed: %v\n", err)
		os.Exit(1)
	}
	if _, err := io.ReadFull(rSeq, chunk2); err != nil {
		fmt.Fprintf(os.Stderr, "chunk 2 read failed: %v\n", err)
		os.Exit(1)
	}
	combined := append(chunk1, chunk2...)
	if !bytes.Equal(combined, expectedOKM1) {
		fmt.Fprintf(os.Stderr, "sequential chunk reads do not match contiguous OKM\n")
		os.Exit(1)
	}

	// 7. hkdf.Expand with different info strings produces cryptographically distinct derived keys from the same PRK
	rInfoA := hkdf.Expand(sha256.New, prk1, []byte("application-context-A"))
	rInfoB := hkdf.Expand(sha256.New, prk1, []byte("application-context-B"))
	outA := make([]byte, 32)
	outB := make([]byte, 32)
	if _, errA := io.ReadFull(rInfoA, outA); errA != nil {
		fmt.Fprintf(os.Stderr, "info A read failed: %v\n", errA)
		os.Exit(1)
	}
	if _, errB := io.ReadFull(rInfoB, outB); errB != nil {
		fmt.Fprintf(os.Stderr, "info B read failed: %v\n", errB)
		os.Exit(1)
	}
	if bytes.Equal(outA, outB) {
		fmt.Fprintf(os.Stderr, "different info strings unexpectedly produced identical keys\n")
		os.Exit(1)
	}

	// 8. hkdf.Expand works with different hash functions such as SHA-1, SHA-384 and SHA-512
	prkSHA1 := []byte{
		0x9b, 0x6c, 0x18, 0xc4, 0x32, 0xa7, 0xbf, 0x8f,
		0x0e, 0x71, 0xc8, 0xeb, 0x88, 0xf4, 0xb3, 0x0b,
		0xaa, 0x2b, 0xa2, 0x43,
	}
	expectedOKMSHA1 := []byte{
		0x08, 0x5a, 0x01, 0xea, 0x1b, 0x10, 0xf3, 0x69,
		0x33, 0x06, 0x8b, 0x56, 0xef, 0xa5, 0xad, 0x81,
		0xa4, 0xf1, 0x4b, 0x82, 0x2f, 0x5b, 0x09, 0x15,
		0x68, 0xa9, 0xcd, 0xd4, 0xf1, 0x55, 0xfd, 0xa2,
		0xc2, 0x2e, 0x42, 0x24, 0x78, 0xd3, 0x05, 0xf3,
		0xf8, 0x96,
	}
	rSHA1 := hkdf.Expand(sha1.New, prkSHA1, info1)
	outSHA1 := make([]byte, len(expectedOKMSHA1))
	if _, err := io.ReadFull(rSHA1, outSHA1); err != nil {
		fmt.Fprintf(os.Stderr, "SHA-1 expand read failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(outSHA1, expectedOKMSHA1) {
		fmt.Fprintf(os.Stderr, "SHA-1 OKM mismatch\n")
		os.Exit(1)
	}

	r384 := hkdf.Expand(sha512.New384, prk1, info1)
	r512 := hkdf.Expand(sha512.New, prk1, info1)
	out384 := make([]byte, 48)
	out512 := make([]byte, 64)
	if _, err := io.ReadFull(r384, out384); err != nil {
		fmt.Fprintf(os.Stderr, "SHA-384 expand read failed: %v\n", err)
		os.Exit(1)
	}
	if _, err := io.ReadFull(r512, out512); err != nil {
		fmt.Fprintf(os.Stderr, "SHA-512 expand read failed: %v\n", err)
		os.Exit(1)
	}
	if len(out384) != 48 || len(out512) != 64 {
		fmt.Fprintf(os.Stderr, "unexpected hash output lengths\n")
		os.Exit(1)
	}

	// 9. hkdf.Expand returns error when requested read length exceeds RFC 5869 maximum expansion limit of 255 * hash.Size
	hashLen := sha256.Size // 32
	maxBytes := 255 * hashLen // 8160 bytes
	rMax := hkdf.Expand(sha256.New, prk1, info1)
	maxBuf := make([]byte, maxBytes)
	if _, err := io.ReadFull(rMax, maxBuf); err != nil {
		fmt.Fprintf(os.Stderr, "reading up to maximum expansion limit failed: %v\n", err)
		os.Exit(1)
	}
	extraByte := make([]byte, 1)
	nExtra, errExtra := rMax.Read(extraByte)
	if errExtra == nil || nExtra != 0 {
		fmt.Fprintf(os.Stderr, "expected error when exceeding 255 * hash.Size bytes, got err=%v n=%d\n", errExtra, nExtra)
		os.Exit(1)
	}

	fmt.Println("All hkdf.Expand contract assertions passed successfully.")
}