golang.org/x/crypto v0.39.0: xts.Cipher.Decrypt, xts.Cipher.Encrypt, xts.NewCipher

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/golang.org/x/crypto@v0.39.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.39.0
Demonstrate these symbols/APIs:
  - xts.Cipher.Decrypt
  - xts.Cipher.Encrypt
  - xts.NewCipher

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:2697a67f7fd22e2d6df0548607a4d60dbc8eff7a71835149b732b9ebacd021b6","contract":["xts.NewCipher rejects odd-length keys because the key is split in half for tweak and block encryption","xts.NewCipher rejects keys whose half-length is invalid for the underlying block cipher","xts.NewCipher initializes an XTS cipher with a 32-byte key for AES-128","xts.Cipher.Encrypt and xts.Cipher.Decrypt round-trip 16-byte block-aligned plaintext for a given sector number","xts.Cipher.Encrypt panics when plaintext length is not a multiple of the 16-byte block size","xts.Cipher.Encrypt produces distinct ciphertexts for identical plaintext under different sector numbers","xts.Cipher.Encrypt matches IEEE P1619 XTS-AES-128 test vector 1 for all-zero key, sector 0, and 32-byte zero plaintext"],"goal":"verify pkg:golang/golang.org/x/crypto@v0.39.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.39.0"],"schemaVersion":1,"symbols":["xts.Cipher.Decrypt","xts.Cipher.Encrypt","xts.NewCipher"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.39.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.39.0","symbols":["xts.Cipher.Decrypt","xts.Cipher.Encrypt","xts.NewCipher"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.24.0

require golang.org/x/crypto v0.39.0

golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=

package main

import (
	"bytes"
	"crypto/aes"
	"encoding/hex"
	"fmt"
	"log"

	"golang.org/x/crypto/xts"
)

func main() {
	// XTS mode splits the key in half: 32 bytes total = two 16-byte AES-128 keys
	key := bytes.Repeat([]byte{0x42}, 32)
	cipher, err := xts.NewCipher(aes.NewCipher, key)
	if err != nil {
		log.Fatalf("xts.NewCipher failed: %v", err)
	}

	plaintext := []byte("0123456789abcdef0123456789abcdef") // 32 bytes (2 blocks)
	ciphertext := make([]byte, len(plaintext))
	decrypted := make([]byte, len(plaintext))
	var sectorNum uint64 = 1

	cipher.Encrypt(ciphertext, plaintext, sectorNum)
	fmt.Printf("Ciphertext: %s\n", hex.EncodeToString(ciphertext))

	cipher.Decrypt(decrypted, ciphertext, sectorNum)
	fmt.Printf("Decrypted:  %s\n", string(decrypted))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/golang.org/x/crypto@v0.39.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.39.0"
  ],
  "symbols": [
    "xts.Cipher.Decrypt",
    "xts.Cipher.Encrypt",
    "xts.NewCipher"
  ]
}

package main

import (
	"bytes"
	"crypto/aes"
	"encoding/hex"
	"fmt"
	"os"

	"golang.org/x/crypto/xts"
)

func main() {
	// 1. xts.NewCipher rejects odd-length keys because the key is split in half for tweak and block encryption
	oddKey := make([]byte, 31)
	if _, err := xts.NewCipher(aes.NewCipher, oddKey); err == nil {
		fmt.Fprintf(os.Stderr, "Expected xts.NewCipher to reject odd-length key\n")
		os.Exit(1)
	}

	// 2. xts.NewCipher rejects keys whose half-length is invalid for the underlying cipher (e.g. 16 bytes -> 8-byte AES key)
	shortKey := make([]byte, 16)
	if _, err := xts.NewCipher(aes.NewCipher, shortKey); err == nil {
		fmt.Fprintf(os.Stderr, "Expected xts.NewCipher to reject 16-byte key for AES\n")
		os.Exit(1)
	}

	// 3. xts.NewCipher succeeds with a 32-byte key (two 16-byte AES-128 keys)
	key := make([]byte, 32)
	for i := range key {
		key[i] = byte(i + 1)
	}
	cipher, err := xts.NewCipher(aes.NewCipher, key)
	if err != nil {
		fmt.Fprintf(os.Stderr, "xts.NewCipher failed on valid 32-byte key: %v\n", err)
		os.Exit(1)
	}

	// 4. xts.Cipher.Encrypt and xts.Cipher.Decrypt round-trip full block multiples for a given sector number
	plaintext := []byte("0123456789abcdeffedcba9876543210") // 32 bytes
	ciphertext := make([]byte, len(plaintext))
	decrypted := make([]byte, len(plaintext))
	cipher.Encrypt(ciphertext, plaintext, 42)
	if bytes.Equal(ciphertext, plaintext) {
		fmt.Fprintf(os.Stderr, "Ciphertext should not equal plaintext\n")
		os.Exit(1)
	}
	cipher.Decrypt(decrypted, ciphertext, 42)
	if !bytes.Equal(decrypted, plaintext) {
		fmt.Fprintf(os.Stderr, "Decrypt did not recover original plaintext\n")
		os.Exit(1)
	}

	// 5. xts.Cipher.Encrypt panics when plaintext length is not a multiple of the 16-byte block size
	unalignedPlaintext := []byte("0123456789abcdef0123456") // 23 bytes
	unalignedCiphertext := make([]byte, len(unalignedPlaintext))
	func() {
		defer func() {
			if r := recover(); r == nil {
				fmt.Fprintf(os.Stderr, "Expected Encrypt to panic on unaligned plaintext length\n")
				os.Exit(1)
			}
		}()
		cipher.Encrypt(unalignedCiphertext, unalignedPlaintext, 7)
	}()

	// 6. xts.Cipher.Encrypt produces distinct ciphertexts for identical plaintext under different sector numbers
	ciphertextSector1 := make([]byte, len(plaintext))
	ciphertextSector2 := make([]byte, len(plaintext))
	cipher.Encrypt(ciphertextSector1, plaintext, 1)
	cipher.Encrypt(ciphertextSector2, plaintext, 2)
	if bytes.Equal(ciphertextSector1, ciphertextSector2) {
		fmt.Fprintf(os.Stderr, "Different sector numbers produced identical ciphertext\n")
		os.Exit(1)
	}

	// 7. xts.Cipher.Encrypt matches IEEE P1619 XTS-AES-128 test vector 1 (all-zero key, sector 0, 32-byte zero plaintext)
	zeroKey := make([]byte, 32)
	zeroCipher, err := xts.NewCipher(aes.NewCipher, zeroKey)
	if err != nil {
		fmt.Fprintf(os.Stderr, "xts.NewCipher failed on zero key: %v\n", err)
		os.Exit(1)
	}
	zeroPt := make([]byte, 32)
	zeroCt := make([]byte, 32)
	zeroCipher.Encrypt(zeroCt, zeroPt, 0)
	expectedHex := "917cf69ebd68b2ec9b9fe9a3eadda692cd43d2f59598ed858c02c2652fbf922e"
	if hex.EncodeToString(zeroCt) != expectedHex {
		fmt.Fprintf(os.Stderr, "IEEE P1619 vector 1 mismatch: got %x, want %s\n", zeroCt, expectedHex)
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}