{"record":{"id":"4938de953e27baf1","repo":"golang/go","slug":"mlkem-invalid-nist-decapsulation-key-length","errorCode":null,"errorMessage":"mlkem: invalid NIST decapsulation key length","messagePattern":"mlkem: invalid NIST decapsulation key length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mlkem/mlkem1024.go","lineNumber":164,"sourceCode":"\t\treturn nil, errors.New(\"mlkem: invalid seed length\")\n\t}\n\td := (*[32]byte)(seed[:32])\n\tz := (*[32]byte)(seed[32:])\n\tkemKeyGen1024(dk, d, z)\n\tfips140.RecordApproved()\n\treturn dk, nil\n}\n\n// TestingOnlyNewDecapsulationKey1024 parses a decapsulation key from its expanded NIST format.\n//\n// Bytes() must not be called on the returned key, as it will not produce the\n// original seed.\n//\n// This function should only be used for ACVP testing. Prefer NewDecapsulationKey1024 for all\n// other purposes.\nfunc TestingOnlyNewDecapsulationKey1024(b []byte) (*DecapsulationKey1024, error) {\n\tif len(b) != decapsulationKeySize1024 {\n\t\treturn nil, errors.New(\"mlkem: invalid NIST decapsulation key length\")\n\t}\n\n\tdk := &DecapsulationKey1024{}\n\tfor i := range dk.s {\n\t\tvar err error\n\t\tdk.s[i], err = polyByteDecode[nttElement](b[:encodingSize12])\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"mlkem: invalid secret key encoding\")\n\t\t}\n\t\tb = b[encodingSize12:]\n\t}\n\n\tek, err := NewEncapsulationKey1024(b[:EncapsulationKeySize1024])\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdk.ρ = ek.ρ\n\tdk.h = ek.h","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mlkem/mlkem1024.go#L146-L182","documentation":"TestingOnlyNewDecapsulationKey1024 parses the expanded NIST-format decapsulation key (the concatenation of s̄, the public key, the public key hash, and the implicit-rejection z). It requires exactly decapsulationKeySize1024 bytes; any other length yields 'invalid NIST decapsulation key length'. Like the mldsa TestingOnly helpers it is intended for ACVP conformance testing, not production use.","triggerScenarios":"Calling TestingOnlyNewDecapsulationKey1024(b) with a slice whose length is not decapsulationKeySize1024 (e.g. feeding the 64-byte seed form, or truncating the expanded blob).","commonSituations":"Passing a d||z seed to the testing-only parser; truncating/over-reading the NIST blob; using this test helper in production code paths.","solutions":["Confirm the input is the expanded NIST form (typically produced/exported by ACVP tooling), not the 64-byte seed.","For production, use NewDecapsulationKey1024 with a 64-byte seed instead.","Round-trip test the blob against Bytes() to confirm size and contents line up."],"exampleFix":"// before\ndk, err := mlkem.TestingOnlyNewDecapsulationKey1024(seed[:])  // 64 bytes, wrong API\n\n// after\ndk, err := mlkem.NewDecapsulationKey1024(seed[:])\n// or, for ACVP tests, pass the full expanded NIST blob of decapsulationKeySize1024 bytes","handlingStrategy":"validation","validationCode":"if len(b) != decapsulationKeySize1024 {\n    return fmt.Errorf(\"NIST decapsulation key must be %d bytes\", decapsulationKeySize1024)\n}","typeGuard":"func isExpandedNISTKey1024(b []byte) bool { return len(b) == decapsulationKeySize1024 }","tryCatchPattern":null,"preventionTips":["Use this API only for ACVP testing.","For production, prefer NewDecapsulationKey1024 with a 64-byte seed.","Round-trip the blob against Bytes() to confirm size and contents."],"tags":["crypto","mlkem","fips","testing","input-length"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}