{"record":{"id":"8829225d3d2f6639","repo":"golang/go","slug":"mlkemtest-encapsulate1024-random-must-be-32-byte","errorCode":null,"errorMessage":"mlkemtest: Encapsulate1024: random must be 32 bytes","messagePattern":"mlkemtest: Encapsulate1024: random must be 32 bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/mlkem/mlkemtest/mlkemtest.go","lineNumber":42,"sourceCode":"\tif fips140only.Enforced() {\n\t\treturn nil, nil, errors.New(\"crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode\")\n\t}\n\tk, err := fips140mlkem.NewEncapsulationKey768(ek.Bytes())\n\tif err != nil {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate768: failed to reconstruct key: \" + err.Error())\n\t}\n\tsharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))\n\treturn sharedKey, ciphertext, nil\n}\n\n// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation\n// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key\n// ek and 32 bytes of randomness.\n//\n// It must only be used for known-answer tests.\nfunc Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {\n\tif len(random) != 32 {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate1024: random must be 32 bytes\")\n\t}\n\tif fips140only.Enforced() {\n\t\treturn nil, nil, errors.New(\"crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode\")\n\t}\n\tk, err := fips140mlkem.NewEncapsulationKey1024(ek.Bytes())\n\tif err != nil {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate1024: failed to reconstruct key: \" + err.Error())\n\t}\n\tsharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))\n\treturn sharedKey, ciphertext, nil\n}\n","sourceCodeStart":24,"sourceCodeEnd":54,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/mlkem/mlkemtest/mlkemtest.go#L24-L54","documentation":"Returned by mlkemtest.Encapsulate1024 (the ML-KEM-1024 derandomized KAT helper) when the randomness slice is not exactly 32 bytes. Identical contract to Encapsulate768: FIPS 203 derandomized encapsulation requires a 32-byte seed. The function is test-only.","triggerScenarios":"Calling Encapsulate1024(ek, random) with a slice whose length is not 32. Reusing a buffer sized for a different scheme.","commonSituations":"Porting 768 test code to 1024 but keeping a wrong-sized buffer. Passing a hex-decoded value of wrong length.","solutions":["Provide exactly 32 bytes: z := make([]byte, 32); crypto/rand.Read(z).","Validate len(random)==32 before calling, returning a clear caller error.","Use ek.Encapsulate() for production randomized encapsulation."],"exampleFix":"// before\nshared, ct, err := mlkemtest.Encapsulate1024(ek, z16) // wrong size\n\n// after\nz := make([]byte, 32)\nrand.Read(z)\nshared, ct, err := mlkemtest.Encapsulate1024(ek, z)","handlingStrategy":"validation","validationCode":"if len(random) != 32 {\n    return nil, nil, fmt.Errorf(\"random must be 32 bytes, got %d\", len(random))\n}\nreturn mlkemtest.Encapsulate1024(ek, random)","typeGuard":"func isValidSeed(b []byte) bool { return len(b) == 32 }","tryCatchPattern":"shared, ct, err := mlkemtest.Encapsulate1024(ek, random)\nif err != nil && strings.Contains(err.Error(), \"random must be 32 bytes\") {\n    random = make([]byte, 32)\n    rand.Read(random)\n    shared, ct, err = mlkemtest.Encapsulate1024(ek, random)\n}\nreturn shared, ct, err","preventionTips":["Use a [32]byte typed variable to make the size compile-time checked.","Keep 768 and 1024 seed generation in one helper to avoid copy errors.","Use ek.Encapsulate() for production randomized encapsulation."],"tags":["cryptography","go","post-quantum","mlkem","test-utility","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}