{"record":{"id":"116773d2694fe429","repo":"golang/go","slug":"mlkem-invalid-encapsulation-key-length-116773","errorCode":null,"errorMessage":"mlkem: invalid encapsulation key length","messagePattern":"mlkem: invalid encapsulation key length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mlkem/mlkem768.go","lineNumber":386,"sourceCode":"\tc = pkeEncrypt(cc, &ek.encryptionKey, m, r)\n\treturn K, c\n}\n\n// NewEncapsulationKey768 parses an encapsulation key from its encoded form.\n// If the encapsulation key is not valid, NewEncapsulationKey768 returns an error.\nfunc NewEncapsulationKey768(encapsulationKey []byte) (*EncapsulationKey768, error) {\n\t// The actual logic is in a separate function to outline this allocation.\n\tek := &EncapsulationKey768{}\n\treturn parseEK(ek, encapsulationKey)\n}\n\n// parseEK parses an encryption key from its encoded form.\n//\n// It implements the initial stages of K-PKE.Encrypt according to FIPS 203,\n// Algorithm 14.\nfunc parseEK(ek *EncapsulationKey768, ekPKE []byte) (*EncapsulationKey768, error) {\n\tif len(ekPKE) != EncapsulationKeySize768 {\n\t\treturn nil, errors.New(\"mlkem: invalid encapsulation key length\")\n\t}\n\n\th := sha3.New256()\n\th.Write(ekPKE)\n\th.Sum(ek.h[:0])\n\n\tfor i := range ek.t {\n\t\tvar err error\n\t\tek.t[i], err = polyByteDecode[nttElement](ekPKE[:encodingSize12])\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tekPKE = ekPKE[encodingSize12:]\n\t}\n\tcopy(ek.ρ[:], ekPKE)\n\n\tfor i := byte(0); i < k; i++ {\n\t\tfor j := byte(0); j < k; j++ {","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mlkem/mlkem768.go#L368-L404","documentation":"Thrown by parseEK (via NewEncapsulationKey768) when the encapsulation-key byte slice length is not exactly EncapsulationKeySize768. 768 analogue of error 382.","triggerScenarios":"Passing a 1024-size public key, an un-decoded base64/hex string, a PEM/DER-wrapped key, or a truncated buffer.","commonSituations":"Hard-coding the 1024 size for a 768 key, forgetting to strip SPKI wrapping, dispatch failure on a multi-algorithm key store, or version drift in EncapsulationKeySize768.","solutions":["Assert len(encapsulationKey) == EncapsulationKeySize768 before calling.","Strip PEM/DER/base64 wrappers; pass raw ML-KEM-768 bytes.","Dispatch on algorithm identifier before selecting the 768 constructor.","Regenerate the key with the current library to rule out format drift."],"exampleFix":"// before\nek, err := mlkem768.NewEncapsulationKey768(pub) // pub is 1024-size\n// after\nif len(pub) != mlkem768.EncapsulationKeySize768 {\n    return fmt.Errorf(\"pub len %d != %d\", len(pub), mlkem768.EncapsulationKeySize768)\n}\nek, err := mlkem768.NewEncapsulationKey768(pub)","handlingStrategy":"validation","validationCode":"if len(ek) != mlkem768.EncapsulationKeySize768 {\n    return fmt.Errorf(\"encapsulation key len %d != %d\", len(ek), mlkem768.EncapsulationKeySize768)\n}","typeGuard":"func isMLKEM768EncapsulationKey(b []byte) bool {\n    return len(b) == mlkem768.EncapsulationKeySize768\n}","tryCatchPattern":"ek, err := mlkem768.NewEncapsulationKey768(pub)\nif err != nil {\n    return fmt.Errorf(\"invalid ML-KEM-768 encapsulation key (len=%d): %w\", len(pub), err)\n}","preventionTips":["Strip PEM/DER/base64 wrappers before passing raw key bytes.","Dispatch on algorithm OID before choosing the 768 constructor.","Pin the library version to avoid silent size drift."],"tags":["mlkem","post-quantum","fips140","crypto","key-parsing","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}