{"record":{"id":"5c4b4e44086f63b3","repo":"golang/go","slug":"mlkem-invalid-encapsulation-key-length","errorCode":null,"errorMessage":"mlkem: invalid encapsulation key length","messagePattern":"mlkem: invalid encapsulation key length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mlkem/mlkem1024.go","lineNumber":327,"sourceCode":"\tc = pkeEncrypt1024(cc, &ek.encryptionKey1024, m, r)\n\treturn K, c\n}\n\n// NewEncapsulationKey1024 parses an encapsulation key from its encoded form.\n// If the encapsulation key is not valid, NewEncapsulationKey1024 returns an error.\nfunc NewEncapsulationKey1024(encapsulationKey []byte) (*EncapsulationKey1024, error) {\n\t// The actual logic is in a separate function to outline this allocation.\n\tek := &EncapsulationKey1024{}\n\treturn parseEK1024(ek, encapsulationKey)\n}\n\n// parseEK1024 parses an encryption key from its encoded form.\n//\n// It implements the initial stages of K-PKE.Encrypt according to FIPS 203,\n// Algorithm 14.\nfunc parseEK1024(ek *EncapsulationKey1024, ekPKE []byte) (*EncapsulationKey1024, error) {\n\tif len(ekPKE) != EncapsulationKeySize1024 {\n\t\treturn nil, errors.New(\"mlkem: invalid encapsulation key length\")\n\t}\n\n\th := sha3.New256()\n\th.Write(ekPKE)\n\th.Sum(ek.h[:0])\n\n\tfor i := range ek.t {\n\t\tvar err error\n\t\tek.t[i], err = polyByteDecode[nttElement](ekPKE[:encodingSize12])\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tekPKE = ekPKE[encodingSize12:]\n\t}\n\tcopy(ek.ρ[:], ekPKE)\n\n\tfor i := byte(0); i < k1024; i++ {\n\t\tfor j := byte(0); j < k1024; j++ {","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mlkem/mlkem1024.go#L309-L345","documentation":"Thrown by parseEK1024 (reached via NewEncapsulationKey1024) when the supplied encapsulation-key byte slice length is not exactly EncapsulationKeySize1024. This is the public-key parsing entry point; the length is the first and strictest invariant before any coefficient decode.","triggerScenarios":"Passing a truncated/padded key, a key encoded for ML-KEM-768, a key still wrapped in a higher-level structure (e.g. X.509 SubjectPublicKeyInfo), or a hex/base64 blob that was decoded with the wrong alphabet or wrong nibble count.","commonSituations":"Hard-coding the wrong constant (using the 768 size for a 1024 key), forgetting to strip a PEM/DER envelope, mixing up byte and base64 lengths, or upgrading from a draft where EncapsulationKeySize1024 differed.","solutions":["Check len(encapsulationKey) == EncapsulationKeySize1024 before calling.","Ensure the bytes are raw ML-KEM-1024 public key material, not PEM/DER/base64.","If loading from a 768/1024-agnostic source, dispatch on the recorded algorithm OID/length first.","Regenerate the key with the current library version to rule out a serialization-format drift."],"exampleFix":"// before\nek, err := mlkem1024.NewEncapsulationKey1024(pub) // pub is 1184 bytes (768 size)\n// after\nif len(pub) != mlkem1024.EncapsulationKeySize1024 {\n    return fmt.Errorf(\"pub len %d != %d\", len(pub), mlkem1024.EncapsulationKeySize1024)\n}\nek, err := mlkem1024.NewEncapsulationKey1024(pub)","handlingStrategy":"validation","validationCode":"if len(ek) != mlkem1024.EncapsulationKeySize1024 {\n    return fmt.Errorf(\"encapsulation key len %d != %d\", len(ek), mlkem1024.EncapsulationKeySize1024)\n}","typeGuard":"func isMLKEM1024EncapsulationKey(b []byte) bool {\n    return len(b) == mlkem1024.EncapsulationKeySize1024\n}","tryCatchPattern":"ek, err := mlkem1024.NewEncapsulationKey1024(pub)\nif err != nil {\n    return fmt.Errorf(\"invalid ML-KEM-1024 encapsulation key (len=%d): %w\", len(pub), err)\n}","preventionTips":["Always strip PEM/DER/base64 wrappers before passing raw key bytes.","Dispatch on algorithm OID for multi-key stores before picking the 1024 constructor.","Pin the library version so EncapsulationKeySize1024 cannot drift silently."],"tags":["mlkem","post-quantum","fips140","crypto","key-parsing","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}