golang.org/x/crypto v0.36.0: argon2.Key

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify argon2.Key in pkg:golang/golang.org/x/crypto@v0.36.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.36.0
Demonstrate these symbols/APIs:
  - argon2.Key
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:175eaffac45d67de2e85607b38caca3794da38b1cf8eec3b5d012c3f8c41d83f","contract":["argon2.Key derives a byte slice of the requested keyLen using the Argon2i algorithm","argon2.Key produces deterministic output for identical password, salt, and cost parameters","argon2.Key produces distinct outputs when password or salt differs"],"goal":"verify argon2.Key in pkg:golang/golang.org/x/crypto@v0.36.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.36.0"],"schemaVersion":1,"symbols":["argon2.Key"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.36.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.36.0","symbols":["argon2.Key"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require golang.org/x/crypto v0.36.0

require golang.org/x/sys v0.47.0 // indirect

golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

package main

import (
	"encoding/hex"
	"fmt"

	"golang.org/x/crypto/argon2"
)

func main() {
	password := []byte("example-password")
	salt := []byte("example-salt-16b")

	time := uint32(1)
	memory := uint32(64 * 1024)
	threads := uint8(4)
	keyLen := uint32(32)

	key := argon2.Key(password, salt, time, memory, threads, keyLen)

	fmt.Printf("Derived key (%d bytes): %s\n", len(key), hex.EncodeToString(key))
}

{
  "schemaVersion": 1,
  "goal": "verify argon2.Key in pkg:golang/golang.org/x/crypto@v0.36.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.36.0"
  ],
  "symbols": [
    "argon2.Key"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"fmt"
	"os"

	"golang.org/x/crypto/argon2"
)

func main() {
	password := []byte("correct-horse-battery-staple")
	salt := []byte("random-salt-1234")
	time := uint32(2)
	memory := uint32(64 * 1024)
	threads := uint8(4)
	keyLen := uint32(32)

	// Assertion 1: argon2.Key derives a byte slice of the requested keyLen using the Argon2i algorithm
	key1 := argon2.Key(password, salt, time, memory, threads, keyLen)
	if len(key1) != int(keyLen) {
		fmt.Fprintf(os.Stderr, "FAIL: expected key length %d, got %d\n", keyLen, len(key1))
		os.Exit(1)
	}

	keyShort := argon2.Key(password, salt, time, memory, threads, 16)
	if len(keyShort) != 16 {
		fmt.Fprintf(os.Stderr, "FAIL: expected key length 16, got %d\n", len(keyShort))
		os.Exit(1)
	}

	keyLong := argon2.Key(password, salt, time, memory, threads, 64)
	if len(keyLong) != 64 {
		fmt.Fprintf(os.Stderr, "FAIL: expected key length 64, got %d\n", len(keyLong))
		os.Exit(1)
	}

	// Assertion 2: argon2.Key produces deterministic output for identical password, salt, and cost parameters
	key1Repeat := argon2.Key(password, salt, time, memory, threads, keyLen)
	if !bytes.Equal(key1, key1Repeat) {
		fmt.Fprintf(os.Stderr, "FAIL: non-deterministic key generation for identical parameters\n")
		os.Exit(1)
	}

	// Assertion 3: argon2.Key produces distinct outputs when password or salt differs
	diffPasswordKey := argon2.Key([]byte("different-password"), salt, time, memory, threads, keyLen)
	if bytes.Equal(key1, diffPasswordKey) {
		fmt.Fprintf(os.Stderr, "FAIL: same key generated for different passwords\n")
		os.Exit(1)
	}

	diffSaltKey := argon2.Key(password, []byte("different-salt-9"), time, memory, threads, keyLen)
	if bytes.Equal(key1, diffSaltKey) {
		fmt.Fprintf(os.Stderr, "FAIL: same key generated for different salts\n")
		os.Exit(1)
	}
}