golang.org/x/crypto v0.54.0: hkdf.New

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify hkdf.New in pkg:golang/golang.org/x/crypto@v0.54.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.54.0
Demonstrate these symbols/APIs:
  - hkdf.New

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:7438cdf2f6be308f11c82356f9f8ae894a55affb35db0ff57947263614b652de","contract":["hkdf.New derives RFC 5869 compliant key material matching standard test vectors","hkdf.New with nil salt derives reproducible keys using default zero-filled salt","hkdf.New produces distinct independent keys when given different info context tags","hkdf.New generates identical output to sequential hkdf.Extract and hkdf.Expand"],"goal":"verify hkdf.New in pkg:golang/golang.org/x/crypto@v0.54.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.54.0"],"schemaVersion":1,"symbols":["hkdf.New"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.54.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.54.0","symbols":["hkdf.New"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.25.0

require golang.org/x/crypto v0.54.0

golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"os"

	"golang.org/x/crypto/hkdf"
)

// DeriveKey derives a subkey of specified length from master secret, salt, and info tag.
func DeriveKey(secret, salt, info []byte, keyLen int) ([]byte, error) {
	kdf := hkdf.New(sha256.New, secret, salt, info)
	key := make([]byte, keyLen)
	if _, err := io.ReadFull(kdf, key); err != nil {
		return nil, fmt.Errorf("failed to read derived key: %w", err)
	}
	return key, nil
}

func main() {
	secret := []byte("master-secret-key-material-for-demonstration")
	salt := make([]byte, 16)
	if _, err := rand.Read(salt); err != nil {
		fmt.Fprintf(os.Stderr, "Error generating salt: %v\n", err)
		os.Exit(1)
	}

	encKey, err := DeriveKey(secret, salt, []byte("encryption-key-v1"), 32)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error deriving encryption key: %v\n", err)
		os.Exit(1)
	}

	authKey, err := DeriveKey(secret, salt, []byte("authentication-key-v1"), 32)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error deriving authentication key: %v\n", err)
		os.Exit(1)
	}

	fmt.Printf("Derived Encryption Key (32 bytes): %s\n", hex.EncodeToString(encKey))
	fmt.Printf("Derived Authentication Key (32 bytes): %s\n", hex.EncodeToString(authKey))
}

{
  "schemaVersion": 1,
  "goal": "verify hkdf.New in pkg:golang/golang.org/x/crypto@v0.54.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.54.0"
  ],
  "symbols": [
    "hkdf.New"
  ]
}

package main

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"
	"os"

	"golang.org/x/crypto/hkdf"
)

func main() {
	// Assertion 1: hkdf.New derives RFC 5869 compliant key material matching standard test vectors
	ikm, _ := hex.DecodeString("0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b")
	salt, _ := hex.DecodeString("000102030405060708090a0b0c")
	info, _ := hex.DecodeString("f0f1f2f3f4f5f6f7f8f9")
	expectedOKM, _ := hex.DecodeString("3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865")

	kdf := hkdf.New(sha256.New, ikm, salt, info)
	okm := make([]byte, len(expectedOKM))
	if _, err := io.ReadFull(kdf, okm); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: RFC 5869 test vector read error: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(okm, expectedOKM) {
		fmt.Fprintf(os.Stderr, "FAIL: RFC 5869 OKM mismatch: got %x, expected %x\n", okm, expectedOKM)
		os.Exit(1)
	}

	// Assertion 2: hkdf.New with nil salt derives reproducible keys using default zero-filled salt
	masterKey := []byte("example-master-secret-data")
	kdfNilSalt1 := hkdf.New(sha256.New, masterKey, nil, []byte("app-info"))
	keyNilSalt1 := make([]byte, 32)
	if _, err := io.ReadFull(kdfNilSalt1, keyNilSalt1); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: read kdfNilSalt1: %v\n", err)
		os.Exit(1)
	}

	kdfNilSalt2 := hkdf.New(sha256.New, masterKey, nil, []byte("app-info"))
	keyNilSalt2 := make([]byte, 32)
	if _, err := io.ReadFull(kdfNilSalt2, keyNilSalt2); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: read kdfNilSalt2: %v\n", err)
		os.Exit(1)
	}

	if !bytes.Equal(keyNilSalt1, keyNilSalt2) {
		fmt.Fprintf(os.Stderr, "FAIL: nil salt keys are not reproducible\n")
		os.Exit(1)
	}

	// Assertion 3: hkdf.New produces distinct independent keys when given different info context tags
	kdfTagA := hkdf.New(sha256.New, masterKey, salt, []byte("context-A"))
	keyTagA := make([]byte, 32)
	if _, err := io.ReadFull(kdfTagA, keyTagA); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: read keyTagA: %v\n", err)
		os.Exit(1)
	}

	kdfTagB := hkdf.New(sha256.New, masterKey, salt, []byte("context-B"))
	keyTagB := make([]byte, 32)
	if _, err := io.ReadFull(kdfTagB, keyTagB); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: read keyTagB: %v\n", err)
		os.Exit(1)
	}

	if bytes.Equal(keyTagA, keyTagB) {
		fmt.Fprintf(os.Stderr, "FAIL: different info tags produced identical keys\n")
		os.Exit(1)
	}

	// Assertion 4: hkdf.New generates identical output to sequential hkdf.Extract and hkdf.Expand
	kdfFull := hkdf.New(sha256.New, masterKey, salt, info)
	outFull := make([]byte, 64)
	if _, err := io.ReadFull(kdfFull, outFull); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: read outFull: %v\n", err)
		os.Exit(1)
	}

	prk := hkdf.Extract(sha256.New, masterKey, salt)
	kdfStep := hkdf.Expand(sha256.New, prk, info)
	outStep := make([]byte, 64)
	if _, err := io.ReadFull(kdfStep, outStep); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: read outStep: %v\n", err)
		os.Exit(1)
	}

	if !bytes.Equal(outFull, outStep) {
		fmt.Fprintf(os.Stderr, "FAIL: hkdf.New output does not match hkdf.Extract + hkdf.Expand\n")
		os.Exit(1)
	}

	fmt.Println("PASS: golang.org/x/crypto/hkdf.New contract verified")
}