{"record":{"id":"490a11b9ae95ac49","repo":"golang/go","slug":"mlkemtest-encapsulate1024-failed-to-reconstruct","errorCode":null,"errorMessage":"mlkemtest: Encapsulate1024: failed to reconstruct key: ","messagePattern":"mlkemtest: Encapsulate1024: failed to reconstruct key: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/mlkem/mlkemtest/mlkemtest.go","lineNumber":49,"sourceCode":"\tsharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))\n\treturn sharedKey, ciphertext, nil\n}\n\n// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation\n// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key\n// ek and 32 bytes of randomness.\n//\n// It must only be used for known-answer tests.\nfunc Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {\n\tif len(random) != 32 {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate1024: random must be 32 bytes\")\n\t}\n\tif fips140only.Enforced() {\n\t\treturn nil, nil, errors.New(\"crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode\")\n\t}\n\tk, err := fips140mlkem.NewEncapsulationKey1024(ek.Bytes())\n\tif err != nil {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate1024: failed to reconstruct key: \" + err.Error())\n\t}\n\tsharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))\n\treturn sharedKey, ciphertext, nil\n}\n","sourceCodeStart":31,"sourceCodeEnd":54,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/mlkem/mlkemtest/mlkemtest.go#L31-L54","documentation":"Returned by mlkemtest.Encapsulate1024 when fips140mlkem.NewEncapsulationKey1024(ek.Bytes()) fails to reconstruct the internal key. The bytes are malformed, truncated, or fail ML-KEM-1024 key-format validation (expected 1568-byte encapsulation key). The wrapper prepends a prefix and re-throws the inner error.","triggerScenarios":"Passing an EncapsulationKey1024 whose Bytes() are corrupt or empty. Feeding 768 key bytes into a 1024 reconstruction path. Key material damaged in storage/transit.","commonSituations":"Deserializing keys from an untrusted blob without length checks. Misconfigured key management returning the wrong key type. Test vectors with copy/paste errors.","solutions":["Verify byte length is 1568 (ML-KEM-1024 ek size) before use.","Construct the key via mlkem.NewEncapsulationKey1024(raw) and check the error.","Regenerate key material if reconstruction consistently fails."],"exampleFix":"// before\nek := &mlkem.EncapsulationKey1024{} // zero value\nshared, ct, err := mlkemtest.Encapsulate1024(ek, z) // reconstruct fails\n\n// after\nif len(raw) != 1568 { return fmt.Errorf(\"bad ek length\") }\nek, err := mlkem.NewEncapsulationKey1024(raw)\nif err != nil { return err }\nshared, ct, err := mlkemtest.Encapsulate1024(ek, z)","handlingStrategy":"try-catch","validationCode":"if len(ek.Bytes()) != 1568 {\n    return nil, nil, fmt.Errorf(\"invalid ML-KEM-1024 ek length\")\n}\nreturn mlkemtest.Encapsulate1024(ek, random)","typeGuard":"func isValidEk1024(ek *mlkem.EncapsulationKey1024) bool {\n    return ek != nil && len(ek.Bytes()) == 1568\n}","tryCatchPattern":"shared, ct, err := mlkemtest.Encapsulate1024(ek, random)\nif err != nil && strings.Contains(err.Error(), \"failed to reconstruct key\") {\n    ek, err = mlkem.NewEncapsulationKey1024(rawSrc)\n    if err != nil { return nil, nil, err }\n    shared, ct, err = mlkemtest.Encapsulate1024(ek, random)\n}\nreturn shared, ct, err","preventionTips":["Construct ek via mlkem.NewEncapsulationKey1024 and check the error.","Validate byte length (1568) before calling the test helper.","Keep 768/1024 key-length constants in a shared config to prevent mix-ups."],"tags":["cryptography","go","post-quantum","mlkem","key-validation","test-utility"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}