{"record":{"id":"9fe23733b0a9e533","repo":"golang/go","slug":"mldsa-invalid-signature-encoding","errorCode":null,"errorMessage":"mldsa: invalid signature encoding","messagePattern":"mldsa: invalid signature encoding","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mldsa/mldsa.go","lineNumber":628,"sourceCode":"\t\t}\n\tcase 88:\n\t\tfor i := range w {\n\t\t\t_, r0 := decompose88(w[i])\n\t\t\tif constantTimeAbs(r0) >= bound {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\tdefault:\n\t\tpanic(\"mldsa: internal error: unsupported γ2\")\n\t}\n\treturn false\n}\n\nvar (\n\terrInvalidSignatureLength           = errors.New(\"mldsa: invalid signature length\")\n\terrInvalidSignatureCoeffBounds      = errors.New(\"mldsa: invalid signature\")\n\terrInvalidSignatureChallenge        = errors.New(\"mldsa: invalid signature\")\n\terrInvalidSignatureHintLimits       = errors.New(\"mldsa: invalid signature encoding\")\n\terrInvalidSignatureHintIndexOrder   = errors.New(\"mldsa: invalid signature encoding\")\n\terrInvalidSignatureHintExtraIndices = errors.New(\"mldsa: invalid signature encoding\")\n)\n\nfunc Verify(pub *PublicKey, msg, sig []byte, context string) error {\n\tfipsSelfTest()\n\tfips140.RecordApproved()\n\tμ, err := computeMessageHash(pub.tr[:], msg, context)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn verifyInternal(pub, &μ, sig)\n}\n\nfunc VerifyExternalMu(pub *PublicKey, μ []byte, sig []byte) error {\n\tfipsSelfTest()\n\tfips140.RecordApproved()\n\tif len(μ) != 64 {","sourceCodeStart":610,"sourceCodeEnd":646,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mldsa/mldsa.go#L610-L646","documentation":"ML-DSA signatures carry a hint vector h used during verification to correct rounding; FIPS 204 limits the total number of hint entries per parameter set (Ω = 80/55/75 for 44/65/87). errInvalidSignatureHintLimits is raised when a decoded signature exceeds that quota, meaning the hint region is structurally invalid. To a caller it is indistinguishable from any other verification failure.","triggerScenarios":"mldsa.Verify on a right-length signature whose hint region encodes more than Ω set bits (corruption, tampering, wrong implementation).","commonSituations":"Bit flips concentrated in the hint region; signature produced by a buggy/non-conformant signer that over-issues hints; cross-variant byte mixing.","solutions":["Surface a generic verification-failure to the caller without distinguishing the hint sub-check.","Re-sign from the original signer; if the failure follows a specific signer, audit its FIPS 204 conformance.","Ensure the message/key/context used in Verify byte-match those used in Sign."],"exampleFix":"// before\nif errors.Is(err, errInvalidSignatureHintLimits) { retry() }  // wrong reflex\n\n// after\nif err := mldsa.Verify(pub, msg, sig, ctx); err != nil {\n    return ErrSignatureInvalid\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {\n    return ErrSignatureInvalid\n}","preventionTips":["Surface one generic verification error for all hint-related failures.","Re-sign from the original signer; reproducible failures imply a non-conformant signer.","Audit the transport/storage layer for bit rot when failures cluster."],"tags":["crypto","mldsa","fips","verification","integrity"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}