crypto/*, compress & math/rand/v2

Hashing, encryption primitives, compression, and randomness live in focused stdlib packages.

Security-sensitive randomness comes from crypto/rand; simulation and shuffling use math/rand/v2.

Compression packages wrap io.Reader and io.Writer so HTTP and file pipelines stay streaming.

Summary

Use crypto/sha256 and friends for checksums and content addressing.

Use crypto/tls and crypto/x509 for HTTPS listeners and mutual TLS.

Use compress/gzip to shrink payloads without loading entire files into memory.

Treat math/rand/v2 as the modern API for non-crypto randomness with explicit Rand values.

Recipe

Quick-reference recipe card - copy-paste ready.

import (
    "crypto/rand"
    "crypto/sha256"
    "encoding/hex"
    "io"
)
 
h := sha256.New()
_, _ = io.Copy(h, reader)
sum := hex.EncodeToString(h.Sum(nil))
 
token := make([]byte, 32)
_, _ = rand.Read(token)

When to reach for this:

• Computing stable hashes for cache keys or integrity checks.
• Generating session tokens, API keys, or nonce bytes.
• Compressing log archives or HTTP responses with gzip.
• Shuffling test fixtures or running simulations with seeded rand/v2.

Working Example

package main
 
import (
    "bytes"
    "compress/gzip"
    "crypto/rand"
    "crypto/sha256"
    "encoding/hex"
    "fmt"
    "io"
    "math/rand/v2"
)
 
func hashAndCompress(in []byte) (digest string, compressed []byte, err error) {
    h := sha256.New()
    if _, err = h.Write(in); err != nil {
        return "", nil, err
    }
    digest = hex.EncodeToString(h.Sum(nil))
 
    var buf bytes.Buffer
    zw := gzip.NewWriter(&buf)
    if _, err = zw.Write(in); err != nil {
        zw.Close()
        return "", nil, err
    }
    if err = zw.Close(); err != nil {
        return "", nil, err
    }
    return digest, buf.Bytes(), nil
}
 
func secureToken(n int) (string, error) {
    b := make([]byte, n)
    if _, err := rand.Read(b); err != nil {
        return "", err
    }
    return hex.EncodeToString(b), nil
}
 
func shuffleDemo(seed uint64, items []string) []string {
    r := rand.New(rand.NewPCG(seed, seed^0x9e3779b97f4a7c15))
    out := append([]string(nil), items...)
    r.Shuffle(len(out), func(i, j int) { out[i], out[j] = out[j], out[i] })
    return out
}
 
func main() {
    payload := []byte("hello stdlib")
    digest, gz, err := hashAndCompress(payload)
    if err != nil {
        panic(err)
    }
    fmt.Println("sha256:", digest)
    fmt.Println("gzip bytes:", len(gz))
 
    tok, err := secureToken(16)
    if err != nil {
        panic(err)
    }
    fmt.Println("token:", tok)
 
    fmt.Println(shuffleDemo(42, []string{"a", "b", "c", "d"}))
}

What this demonstrates:

• sha256.New as io.Writer for incremental hashing.
• gzip.NewWriter with mandatory Close to flush trailers.
• crypto/rand.Read for unpredictable tokens.
• math/rand/v2 with explicit PCG source and Shuffle.

Deep Dive

How It Works

• Hash functions implement hash.Hash (Write, Sum, Reset) for streaming input.
• crypto/rand reads from the OS CSPRNG (getrandom, /dev/urandom, etc.).
• gzip.Writer compresses into an underlying io.Writer; readers decompress symmetrically.
• math/rand/v2 removes global mutable state from the legacy math/rand package design.

Package Map

Go Notes

// Compare digests in constant time when guarding secrets:
import "crypto/subtle"
subtle.ConstantTimeCompare(a, b) == 1
 
// TLS minimum version for servers:
cfg := &tls.Config{MinVersion: tls.VersionTLS12}

Gotchas

• Using math/rand for tokens - Predictable output enables session hijacking. Fix: crypto/rand.Read for secrets; rand/v2 only for non-security uses.
• Forgetting gzip.Writer.Close - Missing gzip footer corrupts compressed output. Fix: always Close and check error.
• Reusing hash.Hash after Sum without Reset - Appends to prior state unexpectedly. Fix: call Reset before hashing a new payload on the same instance.
• Assuming SHA-256 is encryption - Hashes are one-way; they do not encrypt confidential data. Fix: use crypto/aes or TLS for confidentiality.
• Global math/rand in libraries - Tests become flaky when order changes. Fix: inject *rand.Rand from rand/v2 with explicit seed in tests.
• Compressing small payloads - Gzip headers can enlarge tiny bodies. Fix: skip compression below a size threshold (often 1-2 KiB).

Alternatives

FAQs

Related

• os, io, bufio & path/filepath - Streaming data into hashers
• database/sql & net Package Family Overview - TLS listeners and drivers
• log, regexp & text/template - Encoding tokens in logs safely
• Standard Library Best Practices - Security and dependency rules
• net/http Best Practices - TLS and response compression

Stack versions: This page was written for Go 1.26.x (Green Tea GC default, go fix modernizers - verify patch at build), chi (latest - verify at build), gin (latest - verify at build), echo (latest - verify at build), google.golang.org/grpc (latest - verify at build), sigs.k8s.io/controller-runtime (latest - verify at build), kubebuilder (latest - verify at build), tinygo (latest - verify board targets at build), wazero (latest - verify at build), and golangci-lint (latest - verify linter set at build).