golang.org/x/crypto v0.58.0: bcrypt.CompareHashAndPassword

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify golang.org/x/crypto/bcrypt.CompareHashAndPassword in pkg:golang/golang.org/x/crypto@v0.58.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/golang.org/x/crypto@v0.58.0
Demonstrate these symbols/APIs:
  - golang.org/x/crypto/bcrypt.CompareHashAndPassword

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:c8e088388f3a7cb62502a2f3e79f6a85ef9855fba92597f0e22a3ae176c230a5","contract":["bcrypt.CompareHashAndPassword returns nil when password matches the bcrypt hash","bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when password does not match","bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword for empty password against non-empty password hash","bcrypt.CompareHashAndPassword returns nil for empty password against empty password hash","bcrypt.CompareHashAndPassword returns ErrHashTooShort when hashedPassword is too short","bcrypt.CompareHashAndPassword returns ErrMismatchedHashAndPassword when hash digest bytes are altered"],"goal":"verify golang.org/x/crypto/bcrypt.CompareHashAndPassword in pkg:golang/golang.org/x/crypto@v0.58.0","kind":"HOW","packages":["pkg:golang/golang.org/x/crypto@v0.58.0"],"schemaVersion":1,"symbols":["golang.org/x/crypto/bcrypt.CompareHashAndPassword"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/golang.org/x/crypto@v0.58.0"],"schemaVersion":1,"subject":"pkg:golang/golang.org/x/crypto@v0.58.0","symbols":["golang.org/x/crypto/bcrypt.CompareHashAndPassword"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.26.0

require golang.org/x/crypto v0.58.0

golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=

package main

import (
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	secret := []byte("correct-passphrase")
	digest, err := bcrypt.GenerateFromPassword(secret, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "hash error: %v\n", err)
		os.Exit(1)
	}

	if err := bcrypt.CompareHashAndPassword(digest, secret); err != nil {
		fmt.Fprintf(os.Stderr, "compare failed: %v\n", err)
		os.Exit(1)
	}

	if err := bcrypt.CompareHashAndPassword(digest, []byte("wrong-passphrase")); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "expected mismatch error, got: %v\n", err)
		os.Exit(1)
	}

	fmt.Println("bcrypt.CompareHashAndPassword verified")
}

{
  "schemaVersion": 1,
  "goal": "verify golang.org/x/crypto/bcrypt.CompareHashAndPassword in pkg:golang/golang.org/x/crypto@v0.58.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/golang.org/x/crypto@v0.58.0"
  ],
  "symbols": [
    "golang.org/x/crypto/bcrypt.CompareHashAndPassword"
  ]
}

package main

import (
	"errors"
	"fmt"
	"os"

	"golang.org/x/crypto/bcrypt"
)

func main() {
	validPass := []byte("sample-passphrase-123")
	invalidPass := []byte("different-passphrase-456")

	hashed, err := bcrypt.GenerateFromPassword(validPass, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateFromPassword failed: %v\n", err)
		os.Exit(1)
	}

	// 1. CompareHashAndPassword returns nil when password matches the bcrypt hash
	if err := bcrypt.CompareHashAndPassword(hashed, validPass); err != nil {
		fmt.Fprintf(os.Stderr, "expected nil for matching password, got: %v\n", err)
		os.Exit(1)
	}

	// 2. CompareHashAndPassword returns ErrMismatchedHashAndPassword when password does not match
	if err := bcrypt.CompareHashAndPassword(hashed, invalidPass); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "expected ErrMismatchedHashAndPassword for wrong password, got: %v\n", err)
		os.Exit(1)
	}

	// 3. CompareHashAndPassword returns ErrMismatchedHashAndPassword for empty password against non-empty password hash
	if err := bcrypt.CompareHashAndPassword(hashed, nil); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "expected ErrMismatchedHashAndPassword for empty password, got: %v\n", err)
		os.Exit(1)
	}

	// 4. CompareHashAndPassword returns nil for empty password against empty password hash
	emptyHashed, err := bcrypt.GenerateFromPassword([]byte{}, bcrypt.MinCost)
	if err != nil {
		fmt.Fprintf(os.Stderr, "GenerateFromPassword for empty password failed: %v\n", err)
		os.Exit(1)
	}
	if err := bcrypt.CompareHashAndPassword(emptyHashed, []byte{}); err != nil {
		fmt.Fprintf(os.Stderr, "expected nil for matching empty password, got: %v\n", err)
		os.Exit(1)
	}

	// 5. CompareHashAndPassword returns ErrHashTooShort when hashedPassword is too short
	if err := bcrypt.CompareHashAndPassword([]byte("$2a$04$short"), validPass); !errors.Is(err, bcrypt.ErrHashTooShort) {
		fmt.Fprintf(os.Stderr, "expected ErrHashTooShort, got: %v\n", err)
		os.Exit(1)
	}

	// 6. CompareHashAndPassword returns ErrMismatchedHashAndPassword when hash digest bytes are altered
	tampered := append([]byte(nil), hashed...)
	if tampered[len(tampered)-1] == 'A' {
		tampered[len(tampered)-1] = 'B'
	} else {
		tampered[len(tampered)-1] = 'A'
	}
	if err := bcrypt.CompareHashAndPassword(tampered, validPass); !errors.Is(err, bcrypt.ErrMismatchedHashAndPassword) {
		fmt.Fprintf(os.Stderr, "expected ErrMismatchedHashAndPassword for tampered hash, got: %v\n", err)
		os.Exit(1)
	}

	fmt.Println("contract ok")
}