How to derive a shared key with ECDH and HKDF in Go

1package main
2 
3import (
4	"crypto/ecdh"
5	"crypto/ecdsa"
6	"crypto/x509"
7	"encoding/pem"
8	"fmt"
9	"os"
10)
11 
12func readDER(path string) ([]byte, error) {
13	data, err := os.ReadFile(path)
14	if err != nil {
15		return nil, err
16	}
17	block, _ := pem.Decode(data)
18	if block == nil {
19		return nil, fmt.Errorf("%s: no PEM block", path)
20	}
21	return block.Bytes, nil
22}
23 
24// loadPrivateKey returns an *ecdh.PrivateKey for X25519 and NIST-curve PKCS#8 keys alike.
25func loadPrivateKey(path string) (*ecdh.PrivateKey, error) {
26	der, err := readDER(path)
27	if err != nil {
28		return nil, err
29	}
30	parsed, err := x509.ParsePKCS8PrivateKey(der)
31	if err != nil {
32		return nil, err
33	}
34	switch key := parsed.(type) {
35	case *ecdh.PrivateKey: // X25519
36		return key, nil
37	case *ecdsa.PrivateKey: // P-256 keys parse as ECDSA keys
38		return key.ECDH()
39	}
40	return nil, fmt.Errorf("%s: %T cannot do ECDH", path, parsed)
41}
42 
43// loadPublicKey does the same for SPKI ("BEGIN PUBLIC KEY") files.
44func loadPublicKey(path string) (*ecdh.PublicKey, error) {
45	der, err := readDER(path)
46	if err != nil {
47		return nil, err
48	}
49	parsed, err := x509.ParsePKIXPublicKey(der)
50	if err != nil {
51		return nil, err
52	}
53	switch key := parsed.(type) {
54	case *ecdh.PublicKey:
55		return key, nil
56	case *ecdsa.PublicKey:
57		return key.ECDH()
58	}
59	return nil, fmt.Errorf("%s: %T cannot do ECDH", path, parsed)
60}
61 

1package main
2 
3import (
4	"crypto/hkdf"
5	"crypto/sha256"
6	"fmt"
7	"log"
8)
9 
10func main() {
11	for _, files := range [][3]string{
12		{"X25519", "alice-x25519.pem", "bob-x25519.pub.pem"},
13		{"P-256", "alice-p256.pem", "bob-p256.pub.pem"},
14	} {
15		privateKey, err := loadPrivateKey(files[1])
16		if err != nil {
17			log.Fatal(err)
18		}
19		peerKey, err := loadPublicKey(files[2])
20		if err != nil {
21			log.Fatal(err)
22		}
23 
24		shared, err := privateKey.ECDH(peerKey) // the raw shared secret
25		if err != nil {
26			log.Fatal(err)
27		}
28		// HKDF-SHA256 (crypto/hkdf, Go 1.24+): nil salt, info binds the key to its use
29		key, err := hkdf.Key(sha256.New, shared, nil, "AES-256-GCM key v1", 32)
30		if err != nil {
31			log.Fatal(err)
32		}
33		fmt.Printf("%s shared secret: %x\n", files[0], shared)
34		fmt.Printf("%s derived key: %x\n", files[0], key)
35	}
36}
37