{"record":{"id":"6f2cac614802f8c0","repo":"golang/go","slug":"mlkem-invalid-secret-key-encoding","errorCode":null,"errorMessage":"mlkem: invalid secret key encoding","messagePattern":"mlkem: invalid secret key encoding","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mlkem/mlkem1024.go","lineNumber":172,"sourceCode":"\n// TestingOnlyNewDecapsulationKey1024 parses a decapsulation key from its expanded NIST format.\n//\n// Bytes() must not be called on the returned key, as it will not produce the\n// original seed.\n//\n// This function should only be used for ACVP testing. Prefer NewDecapsulationKey1024 for all\n// other purposes.\nfunc TestingOnlyNewDecapsulationKey1024(b []byte) (*DecapsulationKey1024, error) {\n\tif len(b) != decapsulationKeySize1024 {\n\t\treturn nil, errors.New(\"mlkem: invalid NIST decapsulation key length\")\n\t}\n\n\tdk := &DecapsulationKey1024{}\n\tfor i := range dk.s {\n\t\tvar err error\n\t\tdk.s[i], err = polyByteDecode[nttElement](b[:encodingSize12])\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"mlkem: invalid secret key encoding\")\n\t\t}\n\t\tb = b[encodingSize12:]\n\t}\n\n\tek, err := NewEncapsulationKey1024(b[:EncapsulationKeySize1024])\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdk.ρ = ek.ρ\n\tdk.h = ek.h\n\tdk.encryptionKey1024 = ek.encryptionKey1024\n\tb = b[EncapsulationKeySize1024:]\n\n\tif !bytes.Equal(dk.h[:], b[:32]) {\n\t\treturn nil, errors.New(\"mlkem: inconsistent H(ek) in encoded bytes\")\n\t}\n\tb = b[32:]\n","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mlkem/mlkem1024.go#L154-L190","documentation":"Thrown by TestingOnlyNewDecapsulationKey1024 when polyByteDecode fails while parsing one of the k=2 secret polynomial shares (s[i]) from the NIST expanded decapsulation-key byte blob. Each share must decode as a valid 12-bit-per-coefficient NTT element occupying exactly encodingSize12 bytes. ACVP-only constructor; not for production use.","triggerScenarios":"Calling TestingOnlyNewDecapsulationKey1024 with a byte slice whose total length is decapsulationKeySize1024 but whose s-vector region contains coefficients outside the valid 12-bit range (e.g. values >= q=3329) or malformed 12-bit packed bytes. A wrong-length slice is caught earlier (error 380 vs 381 boundary); this fires only after the length gate passes but a coefficient decode fails.","commonSituations":"Feeding an ACVP vector with the wrong byte ordering, using a blob generated for ML-KEM-768 instead of 1024, truncating/corrupting test vectors, or reusing a vector from an older FIPS 203 draft whose serialization changed.","solutions":["Verify the input blob is exactly decapsulationKeySize1024 bytes and was generated for ML-KEM-1024 (not 768).","Confirm each 12-bit coefficient block encodes values in [0, 3328]; reject any blob sourced from a non-ACVP generator.","Use NewDecapsulationKey1024(seed) with a 64-byte d||z seed instead of the NIST-expanded form unless you are running ACVP conformance tests.","Regenerate the vector from a known-good ACVP test vector set matching FIPS 203 final."],"exampleFix":"// before\ndk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(blob) // blob mis-labeled\n// after\nif len(blob) != mlkem1024.DecapsulationKeySize1024() {\n    return fmt.Errorf(\"blob is %d bytes, want %d\", len(blob), mlkem1024.DecapsulationKeySize1024())\n}\ndk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(blob)","handlingStrategy":"validation","validationCode":"// Verify blob length for ML-KEM-1024 NIST format; rely on constructor for coefficient decode.\nif len(b) != mlkem1024.DecapsulationKeySize1024() {\n    return fmt.Errorf(\"len %d != %d\", len(b), mlkem1024.DecapsulationKeySize1024())\n}\ndk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(b)\nif err != nil { return fmt.Errorf(\"malformed ACVP vector: %w\", err) }","typeGuard":"func isLikelyMLKEM1024Blob(b []byte) bool {\n    return len(b) == mlkem1024.DecapsulationKeySize1024()\n}","tryCatchPattern":"dk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(b)\nif err != nil {\n    return fmt.Errorf(\"ACVP vector rejected (param=1024, len=%d): %w\", len(b), err)\n}","preventionTips":["Use TestingOnlyNewDecapsulationKey1024 only for ACVP vectors; prefer the seed-based NewDecapsulationKey1024.","Store the ML-KEM parameter set alongside the blob to avoid cross-set mix-ups.","Re-fetch vectors from a vetted NIST CAVP source after any FIPS 203 revision."],"tags":["mlkem","post-quantum","fips140","crypto","key-parsing","acvp"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}