hkdf: improve example
Change-Id: I540c699baf1f7cbf27da458961d581773f442864
Reviewed-on: https://go-review.googlesource.com/c/144397
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
diff --git a/hkdf/example_test.go b/hkdf/example_test.go
index df84395..e89c260 100644
--- a/hkdf/example_test.go
+++ b/hkdf/example_test.go
@@ -9,49 +9,44 @@
"crypto/rand"
"crypto/sha256"
"fmt"
- "golang.org/x/crypto/hkdf"
"io"
+
+ "golang.org/x/crypto/hkdf"
)
-// Usage example that expands one master key into three other cryptographically
-// secure keys.
+// Usage example that expands one master secret into three other
+// cryptographically secure keys.
func Example_usage() {
- // Underlying hash function to use
+ // Underlying hash function for HMAC.
hash := sha256.New
- // Cryptographically secure master key.
- master := []byte{0x00, 0x01, 0x02, 0x03} // i.e. NOT this.
+ // Cryptographically secure master secret.
+ secret := []byte{0x00, 0x01, 0x02, 0x03} // i.e. NOT this.
- // Non secret salt, optional (can be nil)
- // Recommended: hash-length sized random
+ // Non-secret salt, optional (can be nil).
+ // Recommended: hash-length random value.
salt := make([]byte, hash().Size())
- n, err := io.ReadFull(rand.Reader, salt)
- if n != len(salt) || err != nil {
- fmt.Println("error:", err)
- return
+ if _, err := rand.Read(salt); err != nil {
+ panic(err)
}
- // Non secret context specific info, optional (can be nil).
- // Note, independent from the master key.
- info := []byte{0x03, 0x14, 0x15, 0x92, 0x65}
+ // Non-secret context info, optional (can be nil).
+ info := []byte("hkdf example")
- // Create the key derivation function
- hkdf := hkdf.New(hash, master, salt, info)
+ // Generate three 128-bit derived keys.
+ hkdf := hkdf.New(hash, secret, salt, info)
- // Generate the required keys
- keys := make([][]byte, 3)
- for i := 0; i < len(keys); i++ {
- keys[i] = make([]byte, 24)
- n, err := io.ReadFull(hkdf, keys[i])
- if n != len(keys[i]) || err != nil {
- fmt.Println("error:", err)
- return
+ var keys [][]byte
+ for i := 0; i < 3; i++ {
+ key := make([]byte, 16)
+ if _, err := io.ReadFull(hkdf, key); err != nil {
+ panic(err)
}
+ keys = append(keys, key)
}
- // Keys should contain 192 bit random keys
- for i := 1; i <= len(keys); i++ {
- fmt.Printf("Key #%d: %v\n", i, !bytes.Equal(keys[i-1], make([]byte, 24)))
+ for i := range keys {
+ fmt.Printf("Key #%d: %v\n", i+1, !bytes.Equal(keys[i], make([]byte, 16)))
}
// Output:
