golang.org/x/crypto v0.26.0: argon2.IDKey, argon2.Key

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify argon2.IDKey in pkg:golang/golang.org/x/crypto@v0.26.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.26.0
Demonstrate these symbols/APIs:
  - argon2.IDKey
  - argon2.Key

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:bee52ed94add00c1d1c484b6372f313ac1cd3390df058dfc8af7d87310ba833c","contract":["argon2.IDKey derives deterministic key bytes matching the specified key length","argon2.IDKey produces different derived keys for different passwords with identical salt and cost parameters","argon2.IDKey produces different derived keys for different salts with identical password and cost parameters","argon2.IDKey produces different derived keys when time parameter is varied","argon2.IDKey produces different derived keys when memory parameter is varied","argon2.IDKey produces different derived keys than argon2.Key with identical input parameters","argon2.Key derives a byte slice of the requested keyLen using the Argon2i algorithm"],"goal":"verify argon2.IDKey in pkg:golang/golang.org/x/crypto@v0.26.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.26.0"],"schemaVersion":1,"symbols":["argon2.IDKey","argon2.Key"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.26.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.26.0","symbols":["argon2.IDKey","argon2.Key"],"verifierAdapter":"golang@1"}

module sample

go 1.26.6

require golang.org/x/crypto v0.26.0

require golang.org/x/sys v0.23.0 // indirect

golang.org/x/crypto v0.26.0 h1:RrRspgV4mU+YwB4FYnuBoKsUapNIL5cohGAmSH3azsw=
golang.org/x/crypto v0.26.0/go.mod h1:GY7jblb9wI+FOo5y8/S2oY4zWP07AkOJ4+jxCqdqn54=
golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

package main

import (
	"encoding/hex"
	"fmt"

	"golang.org/x/crypto/argon2"
)

func main() {
	password := []byte("example-secret-passphrase")
	salt := []byte("example-unique-salt-16b")

	// Argon2id parameters
	var (
		time    uint32 = 1
		memory  uint32 = 64 * 1024 // 64 MB in KiB
		threads uint8  = 4
		keyLen  uint32 = 32 // 32-byte (256-bit) key
	)

	// Derive a 32-byte key using Argon2id
	idKey := argon2.IDKey(password, salt, time, memory, threads, keyLen)
	fmt.Printf("Argon2id key length: %d bytes\n", len(idKey))
	fmt.Printf("Argon2id key (hex): %s\n", hex.EncodeToString(idKey))

	// Derive a 32-byte key using Argon2i
	iKey := argon2.Key(password, salt, time, memory, threads, keyLen)
	fmt.Printf("Argon2i key length: %d bytes\n", len(iKey))
	fmt.Printf("Argon2i key (hex): %s\n", hex.EncodeToString(iKey))
}

{
  "schemaVersion": 1,
  "goal": "verify argon2.IDKey in pkg:golang/golang.org/x/crypto@v0.26.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.26.0"
  ],
  "symbols": [
    "argon2.IDKey",
    "argon2.Key"
  ]
}

package main

import (
	"bytes"
	"fmt"
	"os"

	"golang.org/x/crypto/argon2"
)

func main() {
	pass := []byte("secure-user-password")
	salt := []byte("random-salt-1234")

	var (
		time    uint32 = 1
		memory  uint32 = 32 * 1024 // 32 MB in KiB
		threads uint8  = 2
		keyLen  uint32 = 32
	)

	// 1. argon2.IDKey derives deterministic key bytes matching the specified key length
	key1 := argon2.IDKey(pass, salt, time, memory, threads, keyLen)
	if len(key1) != int(keyLen) {
		fmt.Fprintf(os.Stderr, "Expected key length %d, got %d\n", keyLen, len(key1))
		os.Exit(1)
	}

	key2 := argon2.IDKey(pass, salt, time, memory, threads, keyLen)
	if !bytes.Equal(key1, key2) {
		fmt.Fprintf(os.Stderr, "Expected deterministic output for identical parameters, but keys differed\n")
		os.Exit(1)
	}

	// 2. argon2.IDKey produces different derived keys for different passwords with identical salt and cost parameters
	otherPass := []byte("different-user-password")
	keyDiffPass := argon2.IDKey(otherPass, salt, time, memory, threads, keyLen)
	if bytes.Equal(key1, keyDiffPass) {
		fmt.Fprintf(os.Stderr, "Expected different keys for different passwords, but got identical keys\n")
		os.Exit(1)
	}

	// 3. argon2.IDKey produces different derived keys for different salts with identical password and cost parameters
	otherSalt := []byte("different-salt-5678")
	keyDiffSalt := argon2.IDKey(pass, otherSalt, time, memory, threads, keyLen)
	if bytes.Equal(key1, keyDiffSalt) {
		fmt.Fprintf(os.Stderr, "Expected different keys for different salts, but got identical keys\n")
		os.Exit(1)
	}

	// 4. argon2.IDKey produces different derived keys when time parameter is varied
	keyDiffTime := argon2.IDKey(pass, salt, time+1, memory, threads, keyLen)
	if bytes.Equal(key1, keyDiffTime) {
		fmt.Fprintf(os.Stderr, "Expected different keys for different time parameters, but got identical keys\n")
		os.Exit(1)
	}

	// 5. argon2.IDKey produces different derived keys when memory parameter is varied
	keyDiffMemory := argon2.IDKey(pass, salt, time, memory*2, threads, keyLen)
	if bytes.Equal(key1, keyDiffMemory) {
		fmt.Fprintf(os.Stderr, "Expected different keys for different memory parameters, but got identical keys\n")
		os.Exit(1)
	}

	// 6. argon2.IDKey produces different derived keys than argon2.Key with identical input parameters
	argon2iKey := argon2.Key(pass, salt, time, memory, threads, keyLen)
	if bytes.Equal(key1, argon2iKey) {
		fmt.Fprintf(os.Stderr, "Expected argon2.IDKey (Argon2id) to differ from argon2.Key (Argon2i), but got identical keys\n")
		os.Exit(1)
	}

	// 7. argon2.Key derives a byte slice of the requested keyLen using the Argon2i algorithm
	if len(argon2iKey) != int(keyLen) {
		fmt.Fprintf(os.Stderr, "Expected argon2.Key length %d, got %d\n", keyLen, len(argon2iKey))
		os.Exit(1)
	}
	argon2iKey2 := argon2.Key(pass, salt, time, memory, threads, keyLen)
	if !bytes.Equal(argon2iKey, argon2iKey2) {
		fmt.Fprintf(os.Stderr, "Expected deterministic output for argon2.Key, but keys differed\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}