{"record":{"id":"26b1de8df2bd59f6","repo":"golang/go","slug":"invalid-scalar-length-26b1de","errorCode":null,"errorMessage":"invalid scalar length","messagePattern":"invalid scalar length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/nistec/p256.go","lineNumber":402,"sourceCode":"\treturn q\n}\n\n// Select sets q to p1 if cond == 1, and to p2 if cond == 0.\nfunc (q *P256Point) Select(p1, p2 *P256Point, cond int) *P256Point {\n\tq.x.Select(&p1.x, &p2.x, cond)\n\tq.y.Select(&p1.y, &p2.y, cond)\n\tq.z.Select(&p1.z, &p2.z, cond)\n\treturn q\n}\n\n// p256OrdElement is a P-256 scalar field element in [0, ord(G)-1]\n// as four uint64 limbs in little-endian order.\ntype p256OrdElement [4]uint64\n\n// SetBytes sets s to the big-endian value of x, reducing it as necessary.\nfunc (s *p256OrdElement) SetBytes(x []byte) (*p256OrdElement, error) {\n\tif len(x) != 32 {\n\t\treturn nil, errors.New(\"invalid scalar length\")\n\t}\n\n\ts[0] = byteorder.BEUint64(x[24:])\n\ts[1] = byteorder.BEUint64(x[16:])\n\ts[2] = byteorder.BEUint64(x[8:])\n\ts[3] = byteorder.BEUint64(x[:])\n\n\t// Ensure s is in the range [0, ord(G)-1]. Since 2 * ord(G) > 2²⁵⁶, we can\n\t// just conditionally subtract ord(G), keeping the result if it doesn't\n\t// underflow.\n\tt0, b := bits.Sub64(s[0], 0xf3b9cac2fc632551, 0)\n\tt1, b := bits.Sub64(s[1], 0xbce6faada7179e84, b)\n\tt2, b := bits.Sub64(s[2], 0xffffffffffffffff, b)\n\tt3, b := bits.Sub64(s[3], 0xffffffff00000000, b)\n\ttMask := b - 1 // zero if subtraction underflowed\n\ts[0] ^= (t0 ^ s[0]) & tMask\n\ts[1] ^= (t1 ^ s[1]) & tMask\n\ts[2] ^= (t2 ^ s[2]) & tMask","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/nistec/p256.go#L384-L420","documentation":"p256OrdElement.SetBytes requires exactly 32 bytes of big-endian input representing a P-256 scalar. The value is then conditionally reduced into [0, ord(G)-1]. Any length other than 32 is rejected because the P-256 scalar field has a fixed 256-bit width and no variable-length encoding is supported.","triggerScenarios":"Calling s.SetBytes(x) where len(x) != 32. This is a low-level scalar-field API used internally; it does not accept padded, truncated, or hex-encoded values.","commonSituations":"Passing a hex-decoded scalar without stripping the 0x prefix (yields 33 bytes), passing a DER/ASN.1-encoded integer, truncating a key share, or mixing up byte orders between little-endian and big-endian representations.","solutions":["Ensure the scalar byte slice is exactly 32 bytes before calling SetBytes","If the scalar arrives as a big.Int, use bigInt.FillBytes(make([]byte, 32)) to get a fixed-width big-endian encoding","Strip any 0x hex prefix and validate the hex string length is 64 characters before decoding"],"exampleFix":"// before\nvar s p256OrdElement\n_, err := s.SetBytes(scalarBytes) // may be wrong length\n\n// after\nif len(scalarBytes) != 32 {\n    return fmt.Errorf(\"scalar must be 32 bytes, got %d\", len(scalarBytes))\n}\nfixed := make([]byte, 32)\nscalarBigInt.FillBytes(fixed)\n_, err := s.SetBytes(fixed)","handlingStrategy":"validation","validationCode":"func validateP256Scalar(b []byte) error {\n    if len(b) != 32 {\n        return fmt.Errorf(\"scalar must be exactly 32 bytes, got %d\", len(b))\n    }\n    return nil\n}\n\n// Usage:\nif err := validateP256Scalar(scalarBytes); err != nil { return err }\nvar s p256OrdElement\n_, err := s.SetBytes(scalarBytes)","typeGuard":null,"tryCatchPattern":"_, err := s.SetBytes(x)\nif err != nil {\n    return fmt.Errorf(\"invalid scalar: %w\", err)\n}","preventionTips":["Always use fixed 32-byte buffers for P-256 scalars","Use big.Int.FillBytes(make([]byte, 32)) instead of big.Int.Bytes() to guarantee width","Validate hex input is exactly 64 characters before decoding to bytes"],"tags":["crypto","fips140","p256","input-validation","scalar"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}