{"record":{"id":"b2e14f0a04dd784d","repo":"golang/go","slug":"mlkemtest-encapsulate768-random-must-be-32-bytes","errorCode":null,"errorMessage":"mlkemtest: Encapsulate768: random must be 32 bytes","messagePattern":"mlkemtest: Encapsulate768: random must be 32 bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/mlkem/mlkemtest/mlkemtest.go","lineNumber":22,"sourceCode":"\n// Package mlkemtest provides testing functions for the ML-KEM algorithm.\npackage mlkemtest\n\nimport (\n\tfips140mlkem \"crypto/internal/fips140/mlkem\"\n\t\"crypto/internal/fips140only\"\n\t\"crypto/mlkem\"\n\t\"errors\"\n)\n\n// Encapsulate768 implements derandomized ML-KEM-768 encapsulation\n// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key\n// ek and 32 bytes of randomness.\n//\n// It must only be used for known-answer tests.\nfunc Encapsulate768(ek *mlkem.EncapsulationKey768, random []byte) (sharedKey, ciphertext []byte, err error) {\n\tif len(random) != 32 {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate768: random must be 32 bytes\")\n\t}\n\tif fips140only.Enforced() {\n\t\treturn nil, nil, errors.New(\"crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode\")\n\t}\n\tk, err := fips140mlkem.NewEncapsulationKey768(ek.Bytes())\n\tif err != nil {\n\t\treturn nil, nil, errors.New(\"mlkemtest: Encapsulate768: failed to reconstruct key: \" + err.Error())\n\t}\n\tsharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))\n\treturn sharedKey, ciphertext, nil\n}\n\n// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation\n// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key\n// ek and 32 bytes of randomness.\n//\n// It must only be used for known-answer tests.\nfunc Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {","sourceCodeStart":4,"sourceCodeEnd":40,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/mlkem/mlkemtest/mlkemtest.go#L4-L40","documentation":"Returned by mlkemtest.Encapsulate768 (a known-answer-test helper exposing ML-KEM.Encaps_internal) when the randomness slice is not exactly 32 bytes. FIPS 203 derandomized encapsulation requires a 32-byte seed (the 'z' input); any other length is a programmer error. The function is intended only for KAT testing, not production use.","triggerScenarios":"Calling Encapsulate768(ek, random) with a slice of length other than 32. Passing a 16-byte or 64-byte buffer by mistake. Reusing an RNG that returns variable-length output.","commonSituations":"Adapting test code that generated 16 bytes (e.g., for older schemes) to ML-KEM. Passing crypto/rand.Read output without sizing it. Confusing the 32-byte encapsulation seed with the 32-byte shared-secret length.","solutions":["Provide exactly 32 bytes: random := make([]byte, 32); crypto/rand.Read(random).","If you have a fixed-size source, copy 32 bytes: var z [32]byte; ... Encapsulate768(ek, z[:]).","For production, use the standard (randomized) Encapsulate API on mlkem.EncapsulationKey768 instead of the test helper."],"exampleFix":"// before\nz := make([]byte, 16)\nrand.Read(z)\nshared, ct, err := mlkemtest.Encapsulate768(ek, z) // error\n\n// after\nz := make([]byte, 32)\nrand.Read(z)\nshared, ct, err := mlkemtest.Encapsulate768(ek, z)","handlingStrategy":"validation","validationCode":"if len(random) != 32 {\n    return nil, nil, fmt.Errorf(\"random must be 32 bytes, got %d\", len(random))\n}\nreturn mlkemtest.Encapsulate768(ek, random)","typeGuard":"func isValidSeed(b []byte) bool { return len(b) == 32 }","tryCatchPattern":"shared, ct, err := mlkemtest.Encapsulate768(ek, random)\nif err != nil && strings.Contains(err.Error(), \"random must be 32 bytes\") {\n    random = make([]byte, 32)\n    rand.Read(random)\n    shared, ct, err = mlkemtest.Encapsulate768(ek, random)\n}\nreturn shared, ct, err","preventionTips":["Define a typed [32]byte parameter to make the size requirement compiler-enforced.","Generate randomness with make([]byte, 32) inline.","Reserve mlkemtest for KAT use only; use ek.Encapsulate() in production."],"tags":["cryptography","go","post-quantum","mlkem","test-utility","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}