golang.org/x/crypto v0.36.0

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/golang.org/x/crypto@v0.36.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.36.0
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:cdfcee1fa0c3c071b408485d25e87c0628dff4775b87e6f8520a935740b13572","contract":["chacha20poly1305.New creates an AEAD cipher with 12-byte NonceSize and 16-byte Overhead for a 32-byte key","chacha20poly1305.New rejects keys with size other than 32 bytes","chacha20poly1305.NewX creates an XChaCha20-Poly1305 AEAD cipher with 24-byte NonceSize for a 32-byte key","chacha20poly1305.NewX rejects keys with size other than 32 bytes","Seal and Open roundtrip correctly encrypts and decrypts data with matching additional authenticated data","Open returns error when ciphertext or authentication tag is corrupted","Open returns error when additional authenticated data does not match","XChaCha20-Poly1305 Seal and Open roundtrip correctly encrypts and decrypts data with 24-byte nonce"],"goal":"verify pkg:golang/golang.org/x/crypto@v0.36.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.36.0"],"schemaVersion":1},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.36.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.36.0","verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require golang.org/x/crypto v0.36.0

require golang.org/x/sys v0.31.0 // indirect

golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=

package main

import (
	"crypto/rand"
	"fmt"
	"io"
	"log"

	"golang.org/x/crypto/chacha20poly1305"
)

func main() {
	// 32-byte key for ChaCha20-Poly1305
	key := make([]byte, chacha20poly1305.KeySize)
	if _, err := io.ReadFull(rand.Reader, key); err != nil {
		log.Fatalf("Failed to generate key: %v", err)
	}

	// 1. Standard ChaCha20-Poly1305 (12-byte nonce)
	aead, err := chacha20poly1305.New(key)
	if err != nil {
		log.Fatalf("Failed to create AEAD cipher: %v", err)
	}

	nonce := make([]byte, aead.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		log.Fatalf("Failed to generate nonce: %v", err)
	}

	plaintext := []byte("confidential payload message")
	additionalData := []byte("authenticated header context")

	// Encrypt and authenticate
	ciphertext := aead.Seal(nil, nonce, plaintext, additionalData)
	fmt.Printf("Ciphertext length: %d bytes (overhead: %d bytes)\n", len(ciphertext), aead.Overhead())

	// Decrypt and verify
	decrypted, err := aead.Open(nil, nonce, ciphertext, additionalData)
	if err != nil {
		log.Fatalf("Failed to decrypt ciphertext: %v", err)
	}
	fmt.Printf("Decrypted message: %s\n", string(decrypted))

	// 2. Extended-nonce XChaCha20-Poly1305 (24-byte nonce)
	aeadX, err := chacha20poly1305.NewX(key)
	if err != nil {
		log.Fatalf("Failed to create XChaCha20-Poly1305 cipher: %v", err)
	}

	nonceX := make([]byte, aeadX.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonceX); err != nil {
		log.Fatalf("Failed to generate XNonce: %v", err)
	}

	ciphertextX := aeadX.Seal(nil, nonceX, plaintext, additionalData)
	decryptedX, err := aeadX.Open(nil, nonceX, ciphertextX, additionalData)
	if err != nil {
		log.Fatalf("Failed to decrypt XChaCha20-Poly1305 ciphertext: %v", err)
	}
	fmt.Printf("XChaCha20-Poly1305 decrypted message: %s\n", string(decryptedX))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/golang.org/x/crypto@v0.36.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.36.0"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

package main

import (
	"bytes"
	"fmt"
	"os"

	"golang.org/x/crypto/chacha20poly1305"
)

func main() {
	validKey := make([]byte, chacha20poly1305.KeySize)
	for i := range validKey {
		validKey[i] = byte(i + 1)
	}

	invalidKey := make([]byte, 16) // invalid: must be 32 bytes

	// 1. chacha20poly1305.New creates an AEAD cipher with 12-byte NonceSize and 16-byte Overhead for a 32-byte key
	aead, err := chacha20poly1305.New(validKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "chacha20poly1305.New failed with valid key: %v\n", err)
		os.Exit(1)
	}
	if aead.NonceSize() != chacha20poly1305.NonceSize {
		fmt.Fprintf(os.Stderr, "Expected NonceSize %d, got %d\n", chacha20poly1305.NonceSize, aead.NonceSize())
		os.Exit(1)
	}
	if aead.Overhead() != chacha20poly1305.Overhead {
		fmt.Fprintf(os.Stderr, "Expected Overhead %d, got %d\n", chacha20poly1305.Overhead, aead.Overhead())
		os.Exit(1)
	}

	// 2. chacha20poly1305.New rejects keys with size other than 32 bytes
	if _, err := chacha20poly1305.New(invalidKey); err == nil {
		fmt.Fprintf(os.Stderr, "chacha20poly1305.New unexpectedly accepted invalid 16-byte key\n")
		os.Exit(1)
	}

	// 3. chacha20poly1305.NewX creates an XChaCha20-Poly1305 AEAD cipher with 24-byte NonceSize for a 32-byte key
	aeadX, err := chacha20poly1305.NewX(validKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "chacha20poly1305.NewX failed with valid key: %v\n", err)
		os.Exit(1)
	}
	if aeadX.NonceSize() != chacha20poly1305.NonceSizeX {
		fmt.Fprintf(os.Stderr, "Expected NonceSizeX %d, got %d\n", chacha20poly1305.NonceSizeX, aeadX.NonceSize())
		os.Exit(1)
	}
	if aeadX.Overhead() != chacha20poly1305.Overhead {
		fmt.Fprintf(os.Stderr, "Expected Overhead %d for NewX, got %d\n", chacha20poly1305.Overhead, aeadX.Overhead())
		os.Exit(1)
	}

	// 4. chacha20poly1305.NewX rejects keys with size other than 32 bytes
	if _, err := chacha20poly1305.NewX(invalidKey); err == nil {
		fmt.Fprintf(os.Stderr, "chacha20poly1305.NewX unexpectedly accepted invalid 16-byte key\n")
		os.Exit(1)
	}

	// 5. Seal and Open roundtrip correctly encrypts and decrypts data with matching additional authenticated data
	nonce := make([]byte, chacha20poly1305.NonceSize)
	for i := range nonce {
		nonce[i] = byte(i + 10)
	}
	plaintext := []byte("confidential payload for contract testing")
	additionalData := []byte("authenticated context header")

	ciphertext := aead.Seal(nil, nonce, plaintext, additionalData)
	if len(ciphertext) != len(plaintext)+chacha20poly1305.Overhead {
		fmt.Fprintf(os.Stderr, "Ciphertext length mismatch: got %d, want %d\n", len(ciphertext), len(plaintext)+chacha20poly1305.Overhead)
		os.Exit(1)
	}

	decrypted, err := aead.Open(nil, nonce, ciphertext, additionalData)
	if err != nil {
		fmt.Fprintf(os.Stderr, "aead.Open failed to decrypt valid ciphertext: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(decrypted, plaintext) {
		fmt.Fprintf(os.Stderr, "Decrypted text mismatch: got %s, want %s\n", string(decrypted), string(plaintext))
		os.Exit(1)
	}

	// 6. Open returns error when ciphertext or authentication tag is corrupted
	corruptedCiphertext := make([]byte, len(ciphertext))
	copy(corruptedCiphertext, ciphertext)
	corruptedCiphertext[0] ^= 0xff
	if _, err := aead.Open(nil, nonce, corruptedCiphertext, additionalData); err == nil {
		fmt.Fprintf(os.Stderr, "aead.Open unexpectedly succeeded on corrupted ciphertext\n")
		os.Exit(1)
	}

	// 7. Open returns error when additional authenticated data does not match
	mismatchedAD := []byte("tampered context header")
	if _, err := aead.Open(nil, nonce, ciphertext, mismatchedAD); err == nil {
		fmt.Fprintf(os.Stderr, "aead.Open unexpectedly succeeded on mismatched additional data\n")
		os.Exit(1)
	}

	// 8. XChaCha20-Poly1305 Seal and Open roundtrip correctly encrypts and decrypts data with 24-byte nonce
	nonceX := make([]byte, chacha20poly1305.NonceSizeX)
	for i := range nonceX {
		nonceX[i] = byte(i + 20)
	}
	ciphertextX := aeadX.Seal(nil, nonceX, plaintext, additionalData)
	decryptedX, err := aeadX.Open(nil, nonceX, ciphertextX, additionalData)
	if err != nil {
		fmt.Fprintf(os.Stderr, "aeadX.Open failed to decrypt valid XChaCha20 ciphertext: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(decryptedX, plaintext) {
		fmt.Fprintf(os.Stderr, "XChaCha20 decrypted text mismatch: got %s, want %s\n", string(decryptedX), string(plaintext))
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}