{"record":{"id":"93fce741e637fa22","repo":"golang/go","slug":"mldsa-nil-public-key","errorCode":null,"errorMessage":"mldsa: nil public key","messagePattern":"mldsa: nil public key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/mldsa/mldsa_fips140v1.26.go","lineNumber":217,"sourceCode":"// Parameters returns the parameters associated with this public key.\nfunc (pk *PublicKey) Parameters() Parameters {\n\tswitch pk.p.Parameters() {\n\tcase \"ML-DSA-44\":\n\t\treturn MLDSA44()\n\tcase \"ML-DSA-65\":\n\t\treturn MLDSA65()\n\tcase \"ML-DSA-87\":\n\t\treturn MLDSA87()\n\tdefault:\n\t\tpanic(\"mldsa: invalid parameters in public key\")\n\t}\n}\n\n// Verify reports whether signature is a valid signature of message by pk.\n// If opts is nil, it's equivalent to the zero value of Options.\nfunc Verify(pk *PublicKey, message []byte, signature []byte, opts *Options) error {\n\tif pk == nil {\n\t\treturn errors.New(\"mldsa: nil public key\")\n\t}\n\tif pk.p == (mldsa.PublicKey{}) {\n\t\treturn errors.New(\"mldsa: zero public key\")\n\t}\n\tif opts == nil {\n\t\topts = &Options{}\n\t}\n\treturn mldsa.Verify(&pk.p, message, signature, opts.Context)\n}\n","sourceCodeStart":199,"sourceCodeEnd":227,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/mldsa/mldsa_fips140v1.26.go#L199-L227","documentation":"Returned by the package-level Verify function when the *PublicKey argument is nil. Verify immediately dereferences pk.p, so a nil pointer would otherwise panic; this check converts that into an explicit error. It is the first guard before checking the inner key value and before delegating to mldsa.Verify.","triggerScenarios":"Calling mldsa.Verify(nil, message, signature, opts) directly. Passing a *PublicKey field from a struct that was never populated and defaulted to nil.","commonSituations":"Decoding a public key where the decode path returns a nil pointer on failure but the error is ignored. Returning a nil *PublicKey from a lookup/map function and forwarding it to Verify. Test fixtures that declare var pk *mldsa.PublicKey without assignment.","solutions":["Nil-check the public key before calling Verify: if pk == nil { return errors.New(\"...\") }.","Ensure key-decode helpers return a non-nil *PublicKey and that you propagate their error.","Initialize the key via GenerateKey().PublicKey() or Unmarshal/Decode and verify non-nil."],"exampleFix":"// before\nvar pk *mldsa.PublicKey // nil after failed decode\nerr := mldsa.Verify(pk, msg, sig, nil)\n\n// after\npk, err := mldsa.NewPublicKeyFromBytes(raw)\nif err != nil { return err }\nif err := mldsa.Verify(pk, msg, sig, nil); err != nil { return err }","handlingStrategy":"validation","validationCode":"if pk == nil {\n    return errors.New(\"public key is nil\")\n}\nreturn mldsa.Verify(pk, msg, sig, opts)","typeGuard":"func isNonNilPublicKey(pk *PublicKey) bool { return pk != nil }","tryCatchPattern":"if err := mldsa.Verify(pk, msg, sig, opts); err != nil {\n    if strings.Contains(err.Error(), \"nil public key\") {\n        // re-load key, ensure non-nil pointer\n    }\n    return err\n}","preventionTips":["Make key loaders return (*PublicKey, error) and never a nil pointer without error.","Nil-check at API boundaries before forwarding to Verify.","Use constructors rather than raw struct literals for keys."],"tags":["cryptography","go","post-quantum","mldsa","nil-check","verification"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}