golang.org/x/crypto v0.27.0: hkdf.Extract

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/hkdf.Extract in pkg:golang/golang.org/x/crypto@v0.27.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.27.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/hkdf.Extract

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:961ad2202ab94614c70be6e5dfafc0bedff2109f44ac286465e63b7d6e110323","contract":["hkdf.Extract extracts pseudorandom key matching RFC 5869 test case 1 (SHA-256)","hkdf.Extract extracts pseudorandom key matching RFC 5869 test case 2 (SHA-256)","hkdf.Extract extracts pseudorandom key matching RFC 5869 test case 3 with zero-length salt","hkdf.Extract with nil salt produces identical result to hash-length zeros salt","hkdf.Extract returns fixed hash size output for variable length secrets","hkdf.Extract produces distinct pseudorandom keys when secret or salt differs"],"goal":"verify golang.org/x/crypto/hkdf.Extract in pkg:golang/golang.org/x/crypto@v0.27.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.27.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/hkdf.Extract"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.27.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.27.0","symbols":["golang.org/x/crypto/hkdf.Extract"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require golang.org/x/crypto v0.27.0

golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"fmt"
	"io"
	"log"

	"golang.org/x/crypto/hkdf"
)

func main() {
	// Input Keying Material (IKM)
	secret := make([]byte, 32)
	if _, err := io.ReadFull(rand.Reader, secret); err != nil {
		log.Fatalf("Failed to generate secret: %v", err)
	}

	// Salt value (optional in HKDF, but recommended)
	salt := make([]byte, 16)
	if _, err := io.ReadFull(rand.Reader, salt); err != nil {
		log.Fatalf("Failed to generate salt: %v", err)
	}

	// Extract stage: extract a pseudorandom key (PRK) from secret and salt
	prk := hkdf.Extract(sha256.New, secret, salt)
	fmt.Printf("Extracted PRK (%d bytes): %x\n", len(prk), prk)

	// Extract with nil salt defaults to a string of hash.Size zeros
	prkDefaultSalt := hkdf.Extract(sha256.New, secret, nil)
	fmt.Printf("Extracted PRK with default salt (%d bytes): %x\n", len(prkDefaultSalt), prkDefaultSalt)
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/hkdf.Extract in pkg:golang/golang.org/x/crypto@v0.27.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.27.0"
  ],
  "symbols": [
    "golang.org/x/crypto/hkdf.Extract"
  ]
}

package main

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"os"

	"golang.org/x/crypto/hkdf"
)

func main() {
	// RFC 5869 Test Case 1 (SHA-256)
	ikm1 := bytes.Repeat([]byte{0x0b}, 22)
	salt1, _ := hex.DecodeString("000102030405060708090a0b0c")
	expectedPRK1, _ := hex.DecodeString("077709362c2e32df0ddc3f0dc47bba6390b6c73bb50f9c3122ec844ad7c2b3e5")

	// 1. hkdf.Extract extracts pseudorandom key matching RFC 5869 test case 1 (SHA-256)
	prk1 := hkdf.Extract(sha256.New, ikm1, salt1)
	if !bytes.Equal(prk1, expectedPRK1) {
		fmt.Fprintf(os.Stderr, "hkdf.Extract RFC 5869 Case 1 PRK mismatch: got %x, want %x\n", prk1, expectedPRK1)
		os.Exit(1)
	}

	// RFC 5869 Test Case 2 (SHA-256)
	ikm2, _ := hex.DecodeString("000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f404142434445464748494a4b4c4d4e4f")
	salt2, _ := hex.DecodeString("606162636465666768696a6b6c6d6e6f707172737475767778797a7b7c7d7e7f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9fa0a1a2a3a4a5a6a7a8a9aaabacadaeaf")
	expectedPRK2, _ := hex.DecodeString("06a6b88c5853361a06104c9ceb35b45cef760014904671014a193f40c15fc244")

	// 2. hkdf.Extract extracts pseudorandom key matching RFC 5869 test case 2 (SHA-256)
	prk2 := hkdf.Extract(sha256.New, ikm2, salt2)
	if !bytes.Equal(prk2, expectedPRK2) {
		fmt.Fprintf(os.Stderr, "hkdf.Extract RFC 5869 Case 2 PRK mismatch: got %x, want %x\n", prk2, expectedPRK2)
		os.Exit(1)
	}

	// RFC 5869 Test Case 3 (SHA-256, zero-length salt)
	expectedPRK3, _ := hex.DecodeString("19ef24a32c717b167f33a91d6f648bdf96596776afdb6377ac434c1c293ccb04")

	// 3. hkdf.Extract extracts pseudorandom key matching RFC 5869 test case 3 with zero-length salt
	prkNilSalt := hkdf.Extract(sha256.New, ikm1, nil)
	if !bytes.Equal(prkNilSalt, expectedPRK3) {
		fmt.Fprintf(os.Stderr, "hkdf.Extract RFC 5869 Case 3 PRK mismatch: got %x, want %x\n", prkNilSalt, expectedPRK3)
		os.Exit(1)
	}

	// 4. hkdf.Extract with nil salt produces identical result to hash-length zeros salt
	zeroSalt := make([]byte, sha256.Size)
	prkZeroSalt := hkdf.Extract(sha256.New, ikm1, zeroSalt)
	prkEmptySalt := hkdf.Extract(sha256.New, ikm1, []byte{})
	if !bytes.Equal(prkNilSalt, prkZeroSalt) || !bytes.Equal(prkEmptySalt, prkZeroSalt) {
		fmt.Fprintf(os.Stderr, "hkdf.Extract nil/empty salt does not match zero-filled salt\n")
		os.Exit(1)
	}

	// 5. hkdf.Extract returns fixed hash size output for variable length secrets
	prkShort := hkdf.Extract(sha256.New, []byte("x"), salt1)
	prkLong := hkdf.Extract(sha256.New, bytes.Repeat([]byte{0x42}, 10000), salt1)
	if len(prkShort) != sha256.Size || len(prkLong) != sha256.Size {
		fmt.Fprintf(os.Stderr, "hkdf.Extract output length mismatch: short=%d, long=%d, want %d\n", len(prkShort), len(prkLong), sha256.Size)
		os.Exit(1)
	}

	// 6. hkdf.Extract produces distinct pseudorandom keys when secret or salt differs
	prkDiffSecret := hkdf.Extract(sha256.New, []byte("different secret"), salt1)
	prkDiffSalt := hkdf.Extract(sha256.New, ikm1, []byte("different salt"))
	if bytes.Equal(prk1, prkDiffSecret) || bytes.Equal(prk1, prkDiffSalt) || bytes.Equal(prkDiffSecret, prkDiffSalt) {
		fmt.Fprintf(os.Stderr, "hkdf.Extract produced duplicate PRK for different inputs\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}