golang.org/x/crypto v0.20.0: hkdf.Extract

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hkdf.Extract in pkg:golang/golang.org/x/crypto@v0.20.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.20.0
Demonstrate these symbols/APIs:
  - hkdf.Extract

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

package sample

import (
	"bytes"
	"crypto/sha256"
	"crypto/sha512"
	"encoding/hex"
	"testing"

	"golang.org/x/crypto/hkdf"
)

// Helper function to decode hex test vectors
func decodeHex(t *testing.T, s string) []byte {
	t.Helper()
	b, err := hex.DecodeString(s)
	if err != nil {
		t.Fatalf("failed to decode hex string %q: %v", s, err)
	}
	return b
}

func TestHKDFExtractRFC5869Case1(t *testing.T) {
	// RFC 5869 Test Case 1: SHA-256 with non-empty salt
	ikm := decodeHex(t, "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b")
	salt := decodeHex(t, "000102030405060708090a0b0c")
	expectedPRK := decodeHex(t, "077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5")

	prk := hkdf.Extract(sha256.New, ikm, salt)

	if len(prk) != sha256.Size {
		t.Fatalf("expected PRK length %d, got %d", sha256.Size, len(prk))
	}
	if !bytes.Equal(prk, expectedPRK) {
		t.Fatalf("PRK mismatch: got %x, want %x", prk, expectedPRK)
	}
}

func TestHKDFExtractRFC5869Case2(t *testing.T) {
	// RFC 5869 Test Case 2: SHA-256 with 80-byte IKM and 80-byte salt
	ikm := decodeHex(t, "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f")
	salt := decodeHex(t, "606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf")
	expectedPRK := decodeHex(t, "06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244")

	prk := hkdf.Extract(sha256.New, ikm, salt)

	if !bytes.Equal(prk, expectedPRK) {
		t.Fatalf("PRK mismatch: got %x, want %x", prk, expectedPRK)
	}
}

func TestHKDFExtractNilAndEmptySalt(t *testing.T) {
	// RFC 5869 Test Case 3: SHA-256 with zero/nil salt
	ikm := decodeHex(t, "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b")
	expectedPRK := decodeHex(t, "19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04")

	// nil salt
	prkNil := hkdf.Extract(sha256.New, ikm, nil)
	if !bytes.Equal(prkNil, expectedPRK) {
		t.Fatalf("nil salt PRK mismatch: got %x, want %x", prkNil, expectedPRK)
	}

	// empty salt ([]byte{})
	prkEmpty := hkdf.Extract(sha256.New, ikm, []byte{})
	if !bytes.Equal(prkEmpty, expectedPRK) {
		t.Fatalf("empty slice salt PRK mismatch: got %x, want %x", prkEmpty, expectedPRK)
	}

	// explicit zero-filled salt of Hash.Size length
	zeroSalt := make([]byte, sha256.Size)
	prkZero := hkdf.Extract(sha256.New, ikm, zeroSalt)
	if !bytes.Equal(prkNil, prkZero) {
		t.Fatalf("nil salt PRK should match zero-filled salt PRK: got %x, want %x", prkNil, prkZero)
	}
}

func TestHKDFExtractSHA512(t *testing.T) {
	secret := []byte("confidential-application-input-key-material")
	salt := []byte("application-cryptographic-salt-value")

	prk := hkdf.Extract(sha512.New, secret, salt)

	if len(prk) != sha512.Size {
		t.Fatalf("expected PRK length %d for SHA-512, got %d", sha512.Size, len(prk))
	}

	// Determinism
	prk2 := hkdf.Extract(sha512.New, secret, salt)
	if !bytes.Equal(prk, prk2) {
		t.Fatalf("hkdf.Extract is not deterministic: %x != %x", prk, prk2)
	}

	// Different salt produces different PRK
	otherSalt := []byte("different-salt-value")
	prkOther := hkdf.Extract(sha512.New, secret, otherSalt)
	if bytes.Equal(prk, prkOther) {
		t.Fatalf("expected different PRK for different salt")
	}

	// Different secret produces different PRK
	otherSecret := []byte("different-secret-material")
	prkOtherSecret := hkdf.Extract(sha512.New, otherSecret, salt)
	if bytes.Equal(prk, prkOtherSecret) {
		t.Fatalf("expected different PRK for different secret")
	}
}

{"case":{"caseId":"case:sha256:4c9080343e53f5b31a73d3f65295811412dd43057e56bde80576b5179ade75d0","contract":["hkdf.Extract derives exact RFC 5869 pseudorandom key (PRK) for SHA-256 with non-empty salt","hkdf.Extract derives exact RFC 5869 pseudorandom key (PRK) for SHA-256 with 80-byte secret and salt","hkdf.Extract handles nil and empty salt by defaulting to a zero-filled salt matching hash size","hkdf.Extract derives PRK matching hash output length and generates distinct deterministic keys for different inputs"],"goal":"verify hkdf.Extract in pkg:golang/golang.org/x/crypto@v0.20.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.20.0"],"schemaVersion":1,"symbols":["hkdf.Extract"]},"contractCommand":["go","test","-v","./..."],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.20.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.20.0","symbols":["hkdf.Extract"],"verifierAdapter":"golang@1"}

package sample

import (
	"crypto/sha256"
	"crypto/sha512"
	"hash"

	"golang.org/x/crypto/hkdf"
)

// ExtractPRK derives a pseudorandom key (PRK) from the given hash function, secret (IKM), and salt.
// If salt is nil, a default salt of all zeros with the length of the hash function's output is used.
func ExtractPRK(h func() hash.Hash, secret, salt []byte) []byte {
	return hkdf.Extract(h, secret, salt)
}

// ExtractSHA256 derives a pseudorandom key using SHA-256 hash function.
func ExtractSHA256(secret, salt []byte) []byte {
	return hkdf.Extract(sha256.New, secret, salt)
}

// ExtractSHA512 derives a pseudorandom key using SHA-512 hash function.
func ExtractSHA512(secret, salt []byte) []byte {
	return hkdf.Extract(sha512.New, secret, salt)
}

module example.com/hkdf-extract-sample

go 1.25.0

require golang.org/x/crypto v0.20.0

golang.org/x/crypto v0.20.0 h1:jmAMJJZXr5KiCw05dfYK9QnqaqKLYXijU23lsEdcQqg=
golang.org/x/crypto v0.20.0/go.mod h1:Xwo95rrVNIoSMx9wa1JroENMToLWn3RNVrTBpLHgZPQ=

{
  "schemaVersion": 1,
  "goal": "verify hkdf.Extract in pkg:golang/golang.org/x/crypto@v0.20.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.20.0"
  ],
  "symbols": [
    "hkdf.Extract"
  ]
}