{"record":{"id":"a5e68ca4f27a8dc8","repo":"golang/go","slug":"mlkem-invalid-ciphertext-length","errorCode":null,"errorMessage":"mlkem: invalid ciphertext length","messagePattern":"mlkem: invalid ciphertext length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mlkem/mlkem1024.go","lineNumber":404,"sourceCode":"\tv := polyAdd(polyAdd(inverseNTT(vNTT), e2), μ)\n\n\tc := cc[:0]\n\tfor _, f := range u {\n\t\tc = ringCompressAndEncode11(c, f)\n\t}\n\tc = ringCompressAndEncode5(c, v)\n\n\treturn c\n}\n\n// Decapsulate generates a shared key from a ciphertext and a decapsulation key.\n// If the ciphertext is not valid, Decapsulate returns an error.\n//\n// The shared key must be kept secret.\nfunc (dk *DecapsulationKey1024) Decapsulate(ciphertext []byte) (sharedKey []byte, err error) {\n\tfipsSelfTest()\n\tif len(ciphertext) != CiphertextSize1024 {\n\t\treturn nil, errors.New(\"mlkem: invalid ciphertext length\")\n\t}\n\tc := (*[CiphertextSize1024]byte)(ciphertext)\n\t// Note that the hash check (step 3 of the decapsulation input check from\n\t// FIPS 203, Section 7.3) is foregone as a DecapsulationKey is always\n\t// validly generated by ML-KEM.KeyGen_internal.\n\treturn kemDecaps1024(dk, c), nil\n}\n\n// kemDecaps1024 produces a shared key from a ciphertext.\n//\n// It implements ML-KEM.Decaps_internal according to FIPS 203, Algorithm 18.\nfunc kemDecaps1024(dk *DecapsulationKey1024, c *[CiphertextSize1024]byte) (K []byte) {\n\tfips140.RecordApproved()\n\tm := pkeDecrypt1024(&dk.decryptionKey1024, c)\n\tg := sha3.New512()\n\tg.Write(m[:])\n\tg.Write(dk.h[:])\n\tG := g.Sum(make([]byte, 0, 64))","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mlkem/mlkem1024.go#L386-L422","documentation":"Thrown by Decapsulate1024 when the ciphertext byte slice is not exactly CiphertextSize1024 bytes. Length is checked before the SHA3/decapsulation machinery runs; an off-size input cannot be a valid ML-KEM-1024 ciphertext.","triggerScenarios":"Passing a 768-size ciphertext to a 1024 decapsulator, a ciphertext with a transport header still attached, a hex string that was not decoded, or a buffer that was sliced to the wrong bound.","commonSituations":"Cross-parameter-set mix-ups (decapsulator and ciphertext from different ML-KEM variants), network framing not stripped, base64 not decoded, or an off-by-one slice around a ciphertext blob.","solutions":["Assert len(ciphertext) == CiphertextSize1024 before calling Decapsulate.","Confirm the ciphertext was produced by Encapsulate1024 against a 1024 encapsulation key.","Strip any framing/header before passing the raw ciphertext.","Decode base64/hex into a []byte of the expected length."],"exampleFix":"// before\nshared, err := dk.Decapsulate(ct) // ct is 768-size by mistake\n// after\nif len(ct) != mlkem1024.CiphertextSize1024 {\n    return fmt.Errorf(\"ct len %d != %d\", len(ct), mlkem1024.CiphertextSize1024)\n}\nshared, err := dk.Decapsulate(ct)","handlingStrategy":"validation","validationCode":"if len(ct) != mlkem1024.CiphertextSize1024 {\n    return fmt.Errorf(\"ciphertext len %d != %d\", len(ct), mlkem1024.CiphertextSize1024)\n}","typeGuard":"func isMLKEM1024Ciphertext(b []byte) bool {\n    return len(b) == mlkem1024.CiphertextSize1024\n}","tryCatchPattern":"shared, err := dk.Decapsulate(ct)\nif err != nil {\n    return fmt.Errorf(\"decapsulate failed (ct len=%d): %w\", len(ct), err)\n}","preventionTips":["Pair the decapsulator and ciphertext parameter set explicitly (1024 with 1024).","Strip transport framing before calling Decapsulate.","Decode base64/hex into a fixed-length buffer and assert the size."],"tags":["mlkem","post-quantum","fips140","crypto","input-validation","decapsulation"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}