Move HKDF and PBKDF2 fallback logic to cryptobackend

cryptobackend/hkdf/hkdf.go

@@ -4,12 +4,36 @@
 
 package hkdf
 
-import "hash"
+import (
+	"hash"
 
+	"github.com/microsoft/go/cryptobackend"
+)
+
+// Extract generates a pseudorandom key for use with [Expand] from a secret and salt.
+func Extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+	if backend.Enabled && Supports(h()) {
+		return extract(h, secret, salt)
+	}
+	return extractFallback(h, secret, salt)
+}
+
+// Expand derives a key from a pseudorandom key and context info.
+func Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+	if backend.Enabled && Supports(h()) {
+		return expand(h, pseudorandomKey, info, keyLen)
+	}
+	return expandFallback(h, pseudorandomKey, info, keyLen)
+}
+
+// Key derives a key from a secret, salt, and context info.
 func Key[H hash.Hash](h func() H, secret, salt []byte, info string, keyLen int) ([]byte, error) {
-	prk, err := Extract(h, secret, salt)
-	if err != nil {
-		return nil, err
+	if backend.Enabled && Supports(h()) {
+		prk, err := extract(h, secret, salt)
+		if err != nil {
+			return nil, err
+		}
+		return expand(h, prk, info, keyLen)
 	}
-	return Expand(h, prk, info, keyLen)
+	return keyFallback(h, secret, salt, info, keyLen)
 }

cryptobackend/hkdf/hkdf_darwin.go

@@ -18,9 +18,9 @@ func Supports(h hash.Hash) bool {
 	return ok && h.Size() != 16
 }
 
-func Extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+func extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
 	return xcrypto.ExtractHKDF(h, secret, salt)
 }
-func Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+func expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
 	return xcrypto.ExpandHKDF(h, pseudorandomKey, []byte(info), keyLen)
 }

cryptobackend/hkdf/hkdf_msgostd.go

@@ -0,0 +1,24 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build msgostd || cmd_go_bootstrap
+
+package hkdf
+
+import (
+	fallback "crypto/internal/fips140/hkdf"
+	"hash"
+)
+
+func extractFallback[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+	return fallback.Extract(h, secret, salt), nil
+}
+
+func expandFallback[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+	return fallback.Expand(h, pseudorandomKey, info, keyLen), nil
+}
+
+func keyFallback[H hash.Hash](h func() H, secret, salt []byte, info string, keyLen int) ([]byte, error) {
+	return fallback.Key(h, secret, salt, info, keyLen), nil
+}

cryptobackend/hkdf/hkdf_nomsgostd.go

@@ -0,0 +1,21 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !msgostd && !cmd_go_bootstrap
+
+package hkdf
+
+import "hash"
+
+func extractFallback[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+	panic("cryptobackend: not available")
+}
+
+func expandFallback[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+	panic("cryptobackend: not available")
+}
+
+func keyFallback[H hash.Hash](h func() H, secret, salt []byte, info string, keyLen int) ([]byte, error) {
+	panic("cryptobackend: not available")
+}

cryptobackend/hkdf/hkdf_openssl.go

@@ -17,9 +17,9 @@ func Supports(h hash.Hash) bool {
 	return ok && openssl.SupportsHKDF()
 }
 
-func Extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+func extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
 	return openssl.ExtractHKDF(h, secret, salt)
 }
-func Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+func expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
 	return openssl.ExpandHKDF(h, pseudorandomKey, []byte(info), keyLen)
 }

cryptobackend/hkdf/hkdf_windows.go

@@ -17,9 +17,9 @@ func Supports(h hash.Hash) bool {
 	return ok && cng.SupportsHKDF()
 }
 
-func Extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+func extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
 	return cng.ExtractHKDF(h, secret, salt)
 }
-func Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+func expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
 	return cng.ExpandHKDF(h, pseudorandomKey, []byte(info), keyLen)
 }

cryptobackend/hkdf/nobackend.go

@@ -9,9 +9,9 @@ package hkdf
 import "hash"
 
 func Supports(h hash.Hash) bool { panic("cryptobackend: not available") }
-func Extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
+func extract[H hash.Hash](h func() H, secret, salt []byte) ([]byte, error) {
 	panic("cryptobackend: not available")
 }
-func Expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
+func expand[H hash.Hash](h func() H, pseudorandomKey []byte, info string, keyLen int) ([]byte, error) {
 	panic("cryptobackend: not available")
 }

cryptobackend/pbkdf2/nobackend.go

@@ -9,6 +9,6 @@ package pbkdf2
 import "hash"
 
 func Supports(h hash.Hash) bool { panic("cryptobackend: not available") }
-func Key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+func key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
 	panic("cryptobackend: not available")
 }

cryptobackend/pbkdf2/pbkdf2.go

@@ -0,0 +1,23 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package pbkdf2
+
+import (
+	"errors"
+	"hash"
+
+	"github.com/microsoft/go/cryptobackend"
+)
+
+// Key derives a key from a password, salt, and iteration count.
+func Key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+	if backend.Enabled && Supports(h()) {
+		if keyLength <= 0 {
+			return nil, errors.New("pbkdf2: keyLength must be larger than 0")
+		}
+		return key(h, password, salt, iter, keyLength)
+	}
+	return keyFallback(h, password, salt, iter, keyLength)
+}

cryptobackend/pbkdf2/pbkdf2_darwin.go

@@ -18,6 +18,6 @@ func Supports(h hash.Hash) bool {
 	return ok && h.Size() != 16 && (h.BlockSize() == 64 || h.BlockSize() == 128)
 }
 
-func Key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+func key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
 	return xcrypto.PBKDF2([]byte(password), salt, iter, keyLength, h)
 }

cryptobackend/pbkdf2/pbkdf2_msgostd.go

@@ -0,0 +1,16 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build msgostd || cmd_go_bootstrap
+
+package pbkdf2
+
+import (
+	fallback "crypto/internal/fips140/pbkdf2"
+	"hash"
+)
+
+func keyFallback[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+	return fallback.Key(h, password, salt, iter, keyLength)
+}

cryptobackend/pbkdf2/pbkdf2_nomsgostd.go

@@ -0,0 +1,13 @@
+// Copyright 2026 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build !msgostd && !cmd_go_bootstrap
+
+package pbkdf2
+
+import "hash"
+
+func keyFallback[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+	panic("cryptobackend: not available")
+}

cryptobackend/pbkdf2/pbkdf2_openssl.go

@@ -17,6 +17,6 @@ func Supports(h hash.Hash) bool {
 	return ok && openssl.SupportsPBKDF2()
 }
 
-func Key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+func key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
 	return openssl.PBKDF2([]byte(password), salt, iter, keyLength, h)
 }

cryptobackend/pbkdf2/pbkdf2_windows.go

@@ -17,6 +17,6 @@ func Supports(h hash.Hash) bool {
 	return ok
 }
 
-func Key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
+func key[H hash.Hash](h func() H, password string, salt []byte, iter, keyLength int) ([]byte, error) {
 	return cng.PBKDF2([]byte(password), salt, iter, keyLength, h)
 }