{"record":{"id":"3006823db884e8fd","repo":"golang/go","slug":"mlkemtest-encapsulate768-failed-to-reconstruct-k","errorCode":null,"errorMessage":"mlkemtest: Encapsulate768: failed to reconstruct key: ","messagePattern":"mlkemtest: Encapsulate768: failed to reconstruct key: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/mlkem/mlkemtest/mlkemtest.go","lineNumber":29,"sourceCode":"\t\"crypto/mlkem\"\n\t\"errors\"\n)\n\n// Encapsulate768 implements derandomized ML-KEM-768 encapsulation\n// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key\n// ek and 32 bytes of randomness.\n//\n// It must only be used for known-answer tests.\nfunc Encapsulate768(ek *mlkem.EncapsulationKey768, random []byte) (sharedKey, ciphertext []byte, err error) {\n\tif len(random) != 32 {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate768: random must be 32 bytes\")\n\t}\n\tif fips140only.Enforced() {\n\t\treturn nil, nil, errors.New(\"crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode\")\n\t}\n\tk, err := fips140mlkem.NewEncapsulationKey768(ek.Bytes())\n\tif err != nil {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate768: failed to reconstruct key: \" + err.Error())\n\t}\n\tsharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))\n\treturn sharedKey, ciphertext, nil\n}\n\n// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation\n// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key\n// ek and 32 bytes of randomness.\n//\n// It must only be used for known-answer tests.\nfunc Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {\n\tif len(random) != 32 {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate1024: random must be 32 bytes\")\n\t}\n\tif fips140only.Enforced() {\n\t\treturn nil, nil, errors.New(\"crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode\")\n\t}\n\tk, err := fips140mlkem.NewEncapsulationKey1024(ek.Bytes())","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/mlkem/mlkemtest/mlkemtest.go#L11-L47","documentation":"Returned by mlkemtest.Encapsulate768 when reconstructing the internal FIPS encapsulation key from ek.Bytes() fails. The inner call fips140mlkem.NewEncapsulationKey768 returns an error if the byte encoding is malformed, truncated, or fails the module's key-format validation; this wrapper prepends a descriptive prefix and re-throws. It indicates the EncapsulationKey768 passed in is structurally invalid.","triggerScenarios":"Passing an EncapsulationKey768 that was built from corrupted/truncated bytes. Using a key object that was never properly initialized (ek.Bytes() returns empty/garbage). Feeding a 1024 key's bytes into a 768 context.","commonSituations":"Loading an encapsulation key from an untrusted source without prior validation. Test vectors loaded with wrong endianness or length. Key bytes corrupted in transit/storage.","solutions":["Validate the source key first: ensure ek was produced by NewEncapsulationKey768(bytes) with a checked error.","Verify byte length matches ML-KEM-768 encapsulation key size (1184 bytes) before reconstruction.","Regenerate or re-fetch the key material if it fails."],"exampleFix":"// before\nvar ek *mlkem.EncapsulationKey768 // not properly initialized\nshared, ct, err := mlkemtest.Encapsulate768(ek, z) // reconstruct fails\n\n// after\nif len(raw) != 1184 { return fmt.Errorf(\"bad ek length\") }\nek, err := mlkem.NewEncapsulationKey768(raw)\nif err != nil { return err }\nshared, ct, err := mlkemtest.Encapsulate768(ek, z)","handlingStrategy":"try-catch","validationCode":"// Validate the encapsulation key bytes before calling the helper.\nif len(ek.Bytes()) != 1184 {\n    return nil, nil, fmt.Errorf(\"invalid ML-KEM-768 ek length\")\n}\nreturn mlkemtest.Encapsulate768(ek, random)","typeGuard":"func isValidEk768(ek *mlkem.EncapsulationKey768) bool {\n    return ek != nil && len(ek.Bytes()) == 1184\n}","tryCatchPattern":"shared, ct, err := mlkemtest.Encapsulate768(ek, random)\nif err != nil && strings.Contains(err.Error(), \"failed to reconstruct key\") {\n    ek, err = mlkem.NewEncapsulationKey768(rawSrc)\n    if err != nil { return nil, nil, err }\n    shared, ct, err = mlkemtest.Encapsulate768(ek, random)\n}\nreturn shared, ct, err","preventionTips":["Construct ek via mlkem.NewEncapsulationKey768 and check the error.","Validate byte length (1184) before passing to the test helper.","Treat key bytes as untrusted input and validate at the trust boundary."],"tags":["cryptography","go","post-quantum","mlkem","key-validation","test-utility"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}