golang.org/x/crypto v0.55.0: curve25519.X25519

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify curve25519.X25519 in pkg:golang/golang.org/x/crypto@v0.55.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.55.0
Demonstrate these symbols/APIs:
  - curve25519.X25519

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:ec9ce5351dd6dc2f5ebabc303c16fb1e61cad23ad3f0adde40ceb92ce130573d","contract":["curve25519.X25519 computes public key from private scalar and Basepoint","curve25519.X25519 performs Diffie-Hellman key exchange yielding matching shared secret for both parties","curve25519.X25519 computes correct shared secret matching RFC 7748 test vector","curve25519.X25519 rejects low-order points with an error","curve25519.X25519 rejects scalar not equal to 32 bytes with an error","curve25519.X25519 rejects point not equal to 32 bytes with an error"],"goal":"verify curve25519.X25519 in pkg:golang/golang.org/x/crypto@v0.55.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.55.0"],"schemaVersion":1,"symbols":["curve25519.X25519"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.55.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.55.0","symbols":["curve25519.X25519"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.6

require golang.org/x/crypto v0.55.0

golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=

package main

import (
	"bytes"
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"log"

	"golang.org/x/crypto/curve25519"
)

func main() {
	// Generate Alice's private key
	alicePriv := make([]byte, curve25519.ScalarSize)
	if _, err := rand.Read(alicePriv); err != nil {
		log.Fatalf("failed to generate Alice private key: %v", err)
	}

	// Compute Alice's public key using Basepoint
	alicePub, err := curve25519.X25519(alicePriv, curve25519.Basepoint)
	if err != nil {
		log.Fatalf("failed to compute Alice public key: %v", err)
	}
	fmt.Printf("Alice public key: %s\n", hex.EncodeToString(alicePub))

	// Generate Bob's private key
	bobPriv := make([]byte, curve25519.ScalarSize)
	if _, err := rand.Read(bobPriv); err != nil {
		log.Fatalf("failed to generate Bob private key: %v", err)
	}

	// Compute Bob's public key using Basepoint
	bobPub, err := curve25519.X25519(bobPriv, curve25519.Basepoint)
	if err != nil {
		log.Fatalf("failed to compute Bob public key: %v", err)
	}
	fmt.Printf("Bob public key:   %s\n", hex.EncodeToString(bobPub))

	// Alice computes shared secret using Bob's public key
	aliceShared, err := curve25519.X25519(alicePriv, bobPub)
	if err != nil {
		log.Fatalf("Alice failed to compute shared secret: %v", err)
	}

	// Bob computes shared secret using Alice's public key
	bobShared, err := curve25519.X25519(bobPriv, alicePub)
	if err != nil {
		log.Fatalf("Bob failed to compute shared secret: %v", err)
	}

	// Verify both derived the exact same shared secret
	if !bytes.Equal(aliceShared, bobShared) {
		log.Fatalf("shared secrets do not match")
	}

	fmt.Printf("Shared secret:    %s\n", hex.EncodeToString(aliceShared))
	fmt.Println("Key exchange succeeded.")
}

{
  "schemaVersion": 1,
  "goal": "verify curve25519.X25519 in pkg:golang/golang.org/x/crypto@v0.55.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.55.0"
  ],
  "symbols": [
    "curve25519.X25519"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"fmt"
	"os"

	"golang.org/x/crypto/curve25519"
)

func main() {
	// 1. curve25519.X25519 computes public key from private scalar and Basepoint
	priv1 := make([]byte, curve25519.ScalarSize)
	if _, err := rand.Read(priv1); err != nil {
		fmt.Fprintf(os.Stderr, "failed to read random scalar: %v\n", err)
		os.Exit(1)
	}
	pub1, err := curve25519.X25519(priv1, curve25519.Basepoint)
	if err != nil {
		fmt.Fprintf(os.Stderr, "X25519 failed with Basepoint: %v\n", err)
		os.Exit(1)
	}
	if len(pub1) != curve25519.PointSize {
		fmt.Fprintf(os.Stderr, "X25519 returned unexpected public key size: got %d, want %d\n", len(pub1), curve25519.PointSize)
		os.Exit(1)
	}

	// 2. curve25519.X25519 performs Diffie-Hellman key exchange yielding matching shared secret for both parties
	priv2 := make([]byte, curve25519.ScalarSize)
	if _, err := rand.Read(priv2); err != nil {
		fmt.Fprintf(os.Stderr, "failed to read random scalar: %v\n", err)
		os.Exit(1)
	}
	pub2, err := curve25519.X25519(priv2, curve25519.Basepoint)
	if err != nil {
		fmt.Fprintf(os.Stderr, "X25519 failed to generate pub2: %v\n", err)
		os.Exit(1)
	}
	shared1, err := curve25519.X25519(priv1, pub2)
	if err != nil {
		fmt.Fprintf(os.Stderr, "X25519 DH step 1 failed: %v\n", err)
		os.Exit(1)
	}
	shared2, err := curve25519.X25519(priv2, pub1)
	if err != nil {
		fmt.Fprintf(os.Stderr, "X25519 DH step 2 failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(shared1, shared2) {
		fmt.Fprintf(os.Stderr, "DH shared secrets do not match\n")
		os.Exit(1)
	}
	if len(shared1) != 32 {
		fmt.Fprintf(os.Stderr, "DH shared secret length is %d, want 32\n", len(shared1))
		os.Exit(1)
	}

	// 3. curve25519.X25519 computes correct shared secret matching RFC 7748 test vector
	tvIn := []byte{0x66, 0x8f, 0xb9, 0xf7, 0x6a, 0xd9, 0x71, 0xc8, 0x1a, 0xc9, 0x0, 0x7, 0x1a, 0x15, 0x60, 0xbc, 0xe2, 0xca, 0x0, 0xca, 0xc7, 0xe6, 0x7a, 0xf9, 0x93, 0x48, 0x91, 0x37, 0x61, 0x43, 0x40, 0x14}
	tvBase := []byte{0xdb, 0x5f, 0x32, 0xb7, 0xf8, 0x41, 0xe7, 0xa1, 0xa0, 0x9, 0x68, 0xef, 0xfd, 0xed, 0x12, 0x73, 0x5f, 0xc4, 0x7a, 0x3e, 0xb1, 0x3b, 0x57, 0x9a, 0xac, 0xad, 0xea, 0xe8, 0x9, 0x39, 0xa7, 0xdd}
	tvExpect := []byte{0x9, 0xd, 0x85, 0xe5, 0x99, 0xea, 0x8e, 0x2b, 0xee, 0xb6, 0x13, 0x4, 0xd3, 0x7b, 0xe1, 0xe, 0xc5, 0xc9, 0x5, 0xf9, 0x92, 0x7d, 0x32, 0xf4, 0x2a, 0x9a, 0xa, 0xfb, 0x3e, 0xb, 0x40, 0x74}

	tvOut, err := curve25519.X25519(tvIn, tvBase)
	if err != nil {
		fmt.Fprintf(os.Stderr, "X25519 failed on test vector: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(tvOut, tvExpect) {
		fmt.Fprintf(os.Stderr, "X25519 output does not match RFC 7748 test vector: got %x, want %x\n", tvOut, tvExpect)
		os.Exit(1)
	}

	// 4. curve25519.X25519 rejects low-order points with an error
	zeroPoint := make([]byte, curve25519.PointSize)
	if out, err := curve25519.X25519(priv1, zeroPoint); err == nil {
		fmt.Fprintf(os.Stderr, "X25519 expected error for low-order point, got nil (out: %x)\n", out)
		os.Exit(1)
	}

	// 5. curve25519.X25519 rejects scalar not equal to 32 bytes with an error
	shortScalar := make([]byte, 31)
	if _, err := curve25519.X25519(shortScalar, pub1); err == nil {
		fmt.Fprintf(os.Stderr, "X25519 expected error for short scalar, got nil\n")
		os.Exit(1)
	}

	// 6. curve25519.X25519 rejects point not equal to 32 bytes with an error
	shortPoint := make([]byte, 31)
	if _, err := curve25519.X25519(priv1, shortPoint); err == nil {
		fmt.Fprintf(os.Stderr, "X25519 expected error for short point, got nil\n")
		os.Exit(1)
	}

	fmt.Println("All contract assertions passed.")
}