Derive keys using HKDF with SHA256 in Go

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"

	"golang.org/x/crypto/hkdf"
)

func main() {
	// Generate a random source key material (IKM)
	ikm := make([]byte, 32)
	_, err := rand.Read(ikm)
	if err != nil {
		fmt.Println("error generating source key:", err)
		return
	}

	// Optional salt (recommended for security)
	salt := make([]byte, 32)
	_, err = rand.Read(salt)
	if err != nil {
		fmt.Println("error generating salt:", err)
		return
	}

	// Optional info parameter for context
	info := []byte("key derivation context")

	// Create HKDF reader
	hkdf := hkdf.New(sha256.New, ikm, salt, info)

	// Derive multiple keys of different lengths
	key1 := make([]byte, 32) // 256-bit key
	key2 := make([]byte, 16) // 128-bit key
	key3 := make([]byte, 64) // 512-bit key

	// Read the derived keys
	_, err = io.ReadFull(hkdf, key1)
	if err != nil {
		fmt.Println("error deriving key1:", err)
		return
	}

	_, err = io.ReadFull(hkdf, key2)
	if err != nil {
		fmt.Println("error deriving key2:", err)
		return
	}

	_, err = io.ReadFull(hkdf, key3)
	if err != nil {
		fmt.Println("error deriving key3:", err)
		return
	}

	fmt.Println("Source Key Material:", hex.EncodeToString(ikm))
	fmt.Println("Salt:", hex.EncodeToString(salt))
	fmt.Println("Derived Key 1 (32 bytes):", hex.EncodeToString(key1))
	fmt.Println("Derived Key 2 (16 bytes):", hex.EncodeToString(key2))
	fmt.Println("Derived Key 3 (64 bytes):", hex.EncodeToString(key3))
}

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io"

	"golang.org/x/crypto/hkdf"
)

type DerivedKeys struct {
	EncryptionKey []byte
	MACKey        []byte
	IV            []byte
}

func deriveKeys(masterKey []byte, salt []byte, info string) (*DerivedKeys, error) {
	hkdf := hkdf.New(sha256.New, masterKey, salt, []byte(info))

	keys := &DerivedKeys{
		EncryptionKey: make([]byte, 32), // AES-256 key
		MACKey:        make([]byte, 32), // HMAC key
		IV:            make([]byte, 16), // AES IV
	}

	// Derive encryption key
	_, err := io.ReadFull(hkdf, keys.EncryptionKey)
	if err != nil {
		return nil, fmt.Errorf("failed to derive encryption key: %w", err)
	}

	// Derive MAC key
	_, err = io.ReadFull(hkdf, keys.MACKey)
	if err != nil {
		return nil, fmt.Errorf("failed to derive MAC key: %w", err)
	}

	// Derive IV
	_, err = io.ReadFull(hkdf, keys.IV)
	if err != nil {
		return nil, fmt.Errorf("failed to derive IV: %w", err)
	}

	return keys, nil
}

func main() {
	// Master key (could be from password-based key derivation)
	masterKey := make([]byte, 32)
	_, err := rand.Read(masterKey)
	if err != nil {
		fmt.Println("error generating master key:", err)
		return
	}

	// Salt should be unique per derivation
	salt := make([]byte, 32)
	_, err = rand.Read(salt)
	if err != nil {
		fmt.Println("error generating salt:", err)
		return
	}

	// Derive keys for encryption
	keys, err := deriveKeys(masterKey, salt, "encryption-context-v1")
	if err != nil {
		fmt.Println("error deriving keys:", err)
		return
	}

	fmt.Println("Master Key:", hex.EncodeToString(masterKey))
	fmt.Println("Salt:", hex.EncodeToString(salt))
	fmt.Println("Encryption Key:", hex.EncodeToString(keys.EncryptionKey))
	fmt.Println("MAC Key:", hex.EncodeToString(keys.MACKey))
	fmt.Println("IV:", hex.EncodeToString(keys.IV))
}