{"record":{"id":"92f9767bdc6adc3e","repo":"golang/go","slug":"mlkem-invalid-secret-key-encoding-92f976","errorCode":null,"errorMessage":"mlkem: invalid secret key encoding","messagePattern":"mlkem: invalid secret key encoding","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mlkem/mlkem768.go","lineNumber":231,"sourceCode":"\n// TestingOnlyNewDecapsulationKey768 parses a decapsulation key from its expanded NIST format.\n//\n// Bytes() must not be called on the returned key, as it will not produce the\n// original seed.\n//\n// This function should only be used for ACVP testing. Prefer NewDecapsulationKey768 for all\n// other purposes.\nfunc TestingOnlyNewDecapsulationKey768(b []byte) (*DecapsulationKey768, error) {\n\tif len(b) != decapsulationKeySize768 {\n\t\treturn nil, errors.New(\"mlkem: invalid NIST decapsulation key length\")\n\t}\n\n\tdk := &DecapsulationKey768{}\n\tfor i := range dk.s {\n\t\tvar err error\n\t\tdk.s[i], err = polyByteDecode[nttElement](b[:encodingSize12])\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"mlkem: invalid secret key encoding\")\n\t\t}\n\t\tb = b[encodingSize12:]\n\t}\n\n\tek, err := NewEncapsulationKey768(b[:EncapsulationKeySize768])\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdk.ρ = ek.ρ\n\tdk.h = ek.h\n\tdk.encryptionKey = ek.encryptionKey\n\tb = b[EncapsulationKeySize768:]\n\n\tif !bytes.Equal(dk.h[:], b[:32]) {\n\t\treturn nil, errors.New(\"mlkem: inconsistent H(ek) in encoded bytes\")\n\t}\n\tb = b[32:]\n","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mlkem/mlkem768.go#L213-L249","documentation":"Thrown by TestingOnlyNewDecapsulationKey768 when polyByteDecode fails while parsing one of the k secret polynomial shares (s[i]) from the NIST expanded blob. Each share must be a valid 12-bit-per-coefficient NTT element in encodingSize12 bytes. This is the 768 analogue of error 380.","triggerScenarios":"Length check (error 385) passed but a coefficient block encodes a value >= q=3329, the 12-bit packing is bit-misaligned, or the blob was byte-swapped/endianness-corrupted.","commonSituations":"Wrong-endian dump of an ACVP vector, a vector from a draft FIPS 203 serialization, corruption in storage/transit, or a 1024 vector fed to the 768 parser with coincidentally-correct total length.","solutions":["Confirm the vector was generated for ML-KEM-768 under the final FIPS 203 serialization.","Verify each 12-bit coefficient block decodes values in [0, 3328].","Re-fetch the ACVP vector from a trusted source.","Switch to NewDecapsulationKey768 with a 64-byte seed to bypass the expanded-format parsing."],"exampleFix":"// before\ndk, err := mlkem768.TestingOnlyNewDecapsulationKey768(blob)\n// after (validate before parsing)\nif len(blob) != mlkem768.DecapsulationKeySize768() {\n    return errors.New(\"blob length wrong for ML-KEM-768\")\n}\ndk, err := mlkem768.TestingOnlyNewDecapsulationKey768(blob)\nif err != nil { return fmt.Errorf(\"expanded blob decode failed: %w\", err) }","handlingStrategy":"try-catch","validationCode":"if len(b) != mlkem768.DecapsulationKeySize768() {\n    return fmt.Errorf(\"len %d != %d\", len(b), mlkem768.DecapsulationKeySize768())\n}","typeGuard":"func isLikelyMLKEM768Blob(b []byte) bool {\n    return len(b) == mlkem768.DecapsulationKeySize768()\n}","tryCatchPattern":"dk, err := mlkem768.TestingOnlyNewDecapsulationKey768(b)\nif err != nil {\n    return fmt.Errorf(\"malformed ML-KEM-768 ACVP vector (len=%d): %w\", len(b), err)\n}","preventionTips":["Re-fetch ACVP vectors from a trusted NIST CAVP source after each FIPS 203 revision.","Confirm correct endianness when dumping vectors from another tool.","Prefer the seed-based constructor unless ACVP testing is required."],"tags":["mlkem","post-quantum","fips140","crypto","key-parsing","acvp"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}