@noble/hashes 1.4.0: argon2d

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify @noble/hashes.argon2d in pkg:npm/%40noble/hashes@1.4.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/%40noble/hashes@1.4.0
Demonstrate these symbols/APIs:
  - @noble/hashes.argon2d

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:d2645d5bcbf65761a9fcc54851d0cd1ee6ff66ee9c00b1c8f84bc6be5c79d4a1","contract":["assert argon2d produces exact 32-byte tag matching RFC 9106 Section 5.1 standard test vector","assert argon2d accepts string and Uint8Array inputs interchangeably for password and salt","assert argon2d defaults to 32-byte output length and supports custom dkLen lengths","assert argon2d supports optional secret key and personalization parameters","assert argon2d invokes onProgress callback with progress values between 0 and 1 during derivation","assert argon2d validates parameters and rejects salts shorter than 8 bytes, memory smaller than 8*p bytes, non-positive iterations or parallelism, and invalid dkLen"],"goal":"verify @noble/hashes.argon2d in pkg:npm/%40noble/hashes@1.4.0","kind":"HOW","packages":["pkg:npm/%40noble/hashes@1.4.0"],"schemaVersion":1,"symbols":["@noble/hashes.argon2d"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/%40noble/hashes@1.4.0"],"schemaVersion":1,"subject":"pkg:npm/%40noble/hashes@1.4.0","symbols":["@noble/hashes.argon2d"],"verifierAdapter":"node-typescript@1"}

const { argon2d } = require('@noble/hashes/argon2');
const { bytesToHex, utf8ToBytes, toBytes } = require('@noble/hashes/utils');

function toInputBytes(data) {
  if (typeof data === 'string') return utf8ToBytes(data);
  return data;
}

/**
 * Derives a key using Argon2d algorithm.
 * @param {string | Uint8Array} password
 * @param {string | Uint8Array} salt
 * @param {import('@noble/hashes/argon2').ArgonOpts} opts
 * @returns {Uint8Array}
 */
function deriveArgon2d(password, salt, opts) {
  return argon2d(password, salt, opts);
}

/**
 * Derives a key using Argon2d and returns a lowercase hexadecimal string.
 * @param {string | Uint8Array} password
 * @param {string | Uint8Array} salt
 * @param {import('@noble/hashes/argon2').ArgonOpts} opts
 * @returns {string}
 */
function deriveArgon2dHex(password, salt, opts) {
  return bytesToHex(argon2d(password, salt, opts));
}

module.exports = {
  argon2d,
  deriveArgon2d,
  deriveArgon2dHex,
  bytesToHex,
  utf8ToBytes,
  toBytes,
  toInputBytes,
};

{
  "name": "sample-noble-hashes-argon2d",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-noble-hashes-argon2d",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "@noble/hashes": "1.4.0"
      }
    },
    "node_modules/@noble/hashes": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
      "license": "MIT",
      "engines": {
        "node": ">= 16"
      },
      "funding": {
        "url": "https://paulmillr.com/funding/"
      }
    }
  }
}

{
  "name": "sample-noble-hashes-argon2d",
  "version": "1.0.0",
  "description": "Clean-room verification sample for @noble/hashes.argon2d in @noble/hashes",
  "main": "index.js",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "license": "MIT-0",
  "dependencies": {
    "@noble/hashes": "1.4.0"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify @noble/hashes.argon2d in pkg:npm/%40noble/hashes@1.4.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/%40noble/hashes@1.4.0"
  ],
  "symbols": [
    "@noble/hashes.argon2d"
  ]
}

import assert from 'node:assert';
import { argon2d } from '@noble/hashes/argon2';
import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils';
import { deriveArgon2d, deriveArgon2dHex } from '../index.js';

// 1. RFC 9106 Section 5.1 standard test vector for Argon2d
// password: 32 bytes of 0x01
// salt: 16 bytes of 0x02
// secret key: 8 bytes of 0x03
// personalization: 12 bytes of 0x04
// params: t=3, m=32, p=4, dkLen=32, v=0x13
const rfcPassword = new Uint8Array(32).fill(1);
const rfcSalt = new Uint8Array(16).fill(2);
const rfcSecret = new Uint8Array(8).fill(3);
const rfcPers = new Uint8Array(12).fill(4);
const rfcTag = argon2d(rfcPassword, rfcSalt, {
  t: 3,
  m: 32,
  p: 4,
  key: rfcSecret,
  personalization: rfcPers,
  dkLen: 32,
});
assert.strictEqual(
  bytesToHex(rfcTag),
  '512b391b6f1162975371d30919734294f868e3be3984f3c1a13a4db9fabe4acb',
  'Argon2d must produce exact RFC 9106 Section 5.1 standard test vector tag'
);

// 2. Input flexibility: accepts string and Uint8Array inputs interchangeably
const strPwd = 'test-password-input';
const strSalt = 'test-salt-bytes-16';
const tagFromStr = argon2d(strPwd, strSalt, { t: 2, m: 256, p: 1, dkLen: 32 });
const tagFromBytes = argon2d(utf8ToBytes(strPwd), utf8ToBytes(strSalt), { t: 2, m: 256, p: 1, dkLen: 32 });
assert.strictEqual(
  bytesToHex(tagFromStr),
  bytesToHex(tagFromBytes),
  'Argon2d string and Uint8Array inputs must produce identical derived keys'
);

// 3. Output length: default dkLen is 32 bytes and custom dkLen lengths are supported
const defaultTag = argon2d(strPwd, strSalt, { t: 2, m: 256, p: 1 });
assert.strictEqual(defaultTag.length, 32, 'Default dkLen must be 32 bytes');
assert.strictEqual(
  bytesToHex(defaultTag),
  bytesToHex(tagFromStr),
  'Omitting dkLen defaults to 32 bytes output'
);

const tag16 = argon2d(strPwd, strSalt, { t: 2, m: 256, p: 1, dkLen: 16 });
assert.strictEqual(tag16.length, 16, 'Custom dkLen 16 must produce 16-byte key');

const tag64 = argon2d(strPwd, strSalt, { t: 2, m: 256, p: 1, dkLen: 64 });
assert.strictEqual(tag64.length, 64, 'Custom dkLen 64 must produce 64-byte key');

// 4. Optional secret key and personalization support
const tagWithSecret = argon2d(strPwd, strSalt, {
  t: 2,
  m: 256,
  p: 1,
  key: 'secret-key',
  personalization: 'custom-context',
});
assert.notStrictEqual(
  bytesToHex(tagWithSecret),
  bytesToHex(defaultTag),
  'Providing secret key and personalization must alter the derived key'
);

// 5. Progress callback is invoked with normalized progress values
const progressValues = [];
argon2d(strPwd, strSalt, {
  t: 2,
  m: 256,
  p: 1,
  onProgress(progress) {
    progressValues.push(progress);
  },
});
assert(progressValues.length > 0, 'onProgress callback must be invoked during derivation');
assert(
  progressValues.every((p) => typeof p === 'number' && p >= 0 && p <= 1),
  'Progress values must be numbers within 0..1 range'
);

// 6. Parameter validation rejects invalid inputs
assert.throws(
  () => argon2d(strPwd, 'short', { t: 1, m: 32, p: 1 }),
  /salt should be at least 8 bytes/,
  'Must reject salt shorter than 8 bytes'
);
assert.throws(
  () => argon2d(strPwd, strSalt, { t: 1, m: 4, p: 1 }),
  /memory should be at least 8\*p bytes/,
  'Must reject memory cost less than 8*p bytes'
);
assert.throws(
  () => argon2d(strPwd, strSalt, { t: 0, m: 32, p: 1 }),
  /t \(iterations\) should be at least 1/,
  'Must reject iterations less than 1'
);
assert.throws(
  () => argon2d(strPwd, strSalt, { t: 1, m: 32, p: 0 }),
  /p \(parallelism\) should be at least 1/,
  'Must reject parallelism less than 1'
);
assert.throws(
  () => argon2d(strPwd, strSalt, { t: 1, m: 32, p: 1, dkLen: 2 }),
  /dkLen should be at least 4 bytes/,
  'Must reject dkLen less than 4 bytes'
);

// 7. Wrapper helpers match direct library execution
assert.strictEqual(
  bytesToHex(deriveArgon2d(strPwd, strSalt, { t: 2, m: 256, p: 1 })),
  bytesToHex(defaultTag),
  'deriveArgon2d helper must return matching Uint8Array digest'
);
assert.strictEqual(
  deriveArgon2dHex(strPwd, strSalt, { t: 2, m: 256, p: 1 }),
  bytesToHex(defaultTag),
  'deriveArgon2dHex helper must return matching hex string'
);

console.log('All @noble/hashes.argon2d contract assertions passed.');