golang.org/x/crypto v0.27.0: hkdf.Expand

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hkdf.Expand in pkg:golang/golang.org/x/crypto@v0.27.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.27.0
Demonstrate these symbols/APIs:
  - hkdf.Expand
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8d294724ce1866220256a5e7ab9a30c1455cdd14c141d0979d0734723c04f619","contract":["hkdf.Expand derives deterministic key material from PRK and context info using SHA-256","hkdf.Expand produces distinct key streams when given different context info strings","hkdf.Expand yields continuous sequential key bytes across multiple ReadFull calls","hkdf.Expand returns an error when reading beyond the 255 * HashLen limit"],"goal":"verify hkdf.Expand in pkg:golang/golang.org/x/crypto@v0.27.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.27.0"],"schemaVersion":1,"symbols":["hkdf.Expand"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.27.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.27.0","symbols":["hkdf.Expand"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.25.0

require golang.org/x/crypto v0.27.0

golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=

package main

import (
	"crypto/sha256"
	"fmt"
	"io"
	"log"

	"golang.org/x/crypto/hkdf"
)

func main() {
	// Pseudorandom key (PRK), e.g. from HKDF-Extract or pre-shared key
	prk := []byte("01234567890123456789012345678901")
	info := []byte("example-application-context")

	// Expand PRK to derive application key
	reader := hkdf.Expand(sha256.New, prk, info)

	derivedKey := make([]byte, 32)
	if _, err := io.ReadFull(reader, derivedKey); err != nil {
		log.Fatalf("failed to expand key: %v", err)
	}

	fmt.Printf("Derived key of length %d bytes\n", len(derivedKey))
}

{
  "schemaVersion": 1,
  "goal": "verify hkdf.Expand in pkg:golang/golang.org/x/crypto@v0.27.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.27.0"
  ],
  "symbols": [
    "hkdf.Expand"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"crypto/sha256"
	"fmt"
	"io"
	"os"

	"golang.org/x/crypto/hkdf"
)

func main() {
	prk := []byte("01234567890123456789012345678901") // 32-byte PRK
	infoA := []byte("context-service-a")
	infoB := []byte("context-service-b")

	// Assertion 1: hkdf.Expand derives deterministic key material from PRK and context info using SHA-256
	reader1 := hkdf.Expand(sha256.New, prk, infoA)
	key1 := make([]byte, 48)
	if _, err := io.ReadFull(reader1, key1); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: ReadFull reader1 failed: %v\n", err)
		os.Exit(1)
	}

	reader2 := hkdf.Expand(sha256.New, prk, infoA)
	key2 := make([]byte, 48)
	if _, err := io.ReadFull(reader2, key2); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: ReadFull reader2 failed: %v\n", err)
		os.Exit(1)
	}

	if !bytes.Equal(key1, key2) {
		fmt.Fprintf(os.Stderr, "assertion 1 failed: deterministic outputs do not match\n")
		os.Exit(1)
	}

	// Assertion 2: hkdf.Expand produces distinct key streams when given different context info strings
	readerDifferentInfo := hkdf.Expand(sha256.New, prk, infoB)
	keyDifferent := make([]byte, 48)
	if _, err := io.ReadFull(readerDifferentInfo, keyDifferent); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 2 failed: ReadFull readerDifferentInfo failed: %v\n", err)
		os.Exit(1)
	}

	if bytes.Equal(key1, keyDifferent) {
		fmt.Fprintf(os.Stderr, "assertion 2 failed: expected different key streams for different info\n")
		os.Exit(1)
	}

	// Assertion 3: hkdf.Expand yields continuous sequential key bytes across multiple ReadFull calls
	readerSequential := hkdf.Expand(sha256.New, prk, infoA)
	part1 := make([]byte, 24)
	part2 := make([]byte, 24)
	if _, err := io.ReadFull(readerSequential, part1); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 3 failed: ReadFull part1 failed: %v\n", err)
		os.Exit(1)
	}
	if _, err := io.ReadFull(readerSequential, part2); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 3 failed: ReadFull part2 failed: %v\n", err)
		os.Exit(1)
	}
	combined := append(part1, part2...)
	if !bytes.Equal(combined, key1) {
		fmt.Fprintf(os.Stderr, "assertion 3 failed: sequential reads do not match single read\n")
		os.Exit(1)
	}

	// Assertion 4: hkdf.Expand returns an error when reading beyond the 255 * HashLen limit
	readerLimit := hkdf.Expand(sha256.New, prk, infoA)
	maxLen := 255 * sha256.Size
	maxBuf := make([]byte, maxLen)
	if _, err := io.ReadFull(readerLimit, maxBuf); err != nil {
		fmt.Fprintf(os.Stderr, "assertion 4 failed: could not read max allowed length: %v\n", err)
		os.Exit(1)
	}

	extraByte := make([]byte, 1)
	_, err := readerLimit.Read(extraByte)
	if err == nil {
		fmt.Fprintf(os.Stderr, "assertion 4 failed: expected error when reading beyond 255 * HashLen\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}