{"record":{"id":"c08aab66b4c26909","repo":"golang/go","slug":"invalid-scalar-length-c08aab","errorCode":null,"errorMessage":"invalid scalar length","messagePattern":"invalid scalar length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/nistec/p521.go","lineNumber":414,"sourceCode":"\t\tfor i := 0; i < p521ElementLength*2; i++ {\n\t\t\tp521GeneratorTable[i][0] = NewP521Point().Set(base)\n\t\t\tfor j := 1; j < 15; j++ {\n\t\t\t\tp521GeneratorTable[i][j] = NewP521Point().Add(p521GeneratorTable[i][j-1], base)\n\t\t\t}\n\t\t\tbase.Double(base)\n\t\t\tbase.Double(base)\n\t\t\tbase.Double(base)\n\t\t\tbase.Double(base)\n\t\t}\n\t})\n\treturn p521GeneratorTable\n}\n\n// ScalarBaseMult sets p = scalar * B, where B is the canonical generator, and\n// returns p.\nfunc (p *P521Point) ScalarBaseMult(scalar []byte) (*P521Point, error) {\n\tif len(scalar) != p521ElementLength {\n\t\treturn nil, errors.New(\"invalid scalar length\")\n\t}\n\ttables := p.generatorTable()\n\n\t// This is also a scalar multiplication with a four-bit window like in\n\t// ScalarMult, but in this case the doublings are precomputed. The value\n\t// [windowValue]G added at iteration k would normally get doubled\n\t// (totIterations-k)×4 times, but with a larger precomputation we can\n\t// instead add [2^((totIterations-k)×4)][windowValue]G and avoid the\n\t// doublings between iterations.\n\tt := NewP521Point()\n\tp.Set(NewP521Point())\n\ttableIndex := len(tables) - 1\n\tfor _, byte := range scalar {\n\t\twindowValue := byte >> 4\n\t\ttables[tableIndex].Select(t, windowValue)\n\t\tp.Add(p, t)\n\t\ttableIndex--\n","sourceCodeStart":396,"sourceCodeEnd":432,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/nistec/p521.go#L396-L432","documentation":"P521Point.ScalarBaseMult computes p = scalar * B (canonical P-521 generator). The scalar must be exactly p521ElementLength bytes (66 bytes) in big-endian order. P-521 field and scalar elements are 521 bits, which requires 66 bytes (with 7 padding bits in the most significant byte). Any other length is rejected.","triggerScenarios":"Calling p.ScalarBaseMult(scalar) where len(scalar) != 66.","commonSituations":"Using a 64-byte (512-bit) or 32-byte scalar by mistake; encoding a P-521 private key with big.Int.Bytes() which strips leading zero bytes; passing a P-256-sized scalar to a P-521 operation due to curve confusion.","solutions":["Pad the scalar to exactly 66 bytes using big.Int.FillBytes(make([]byte, 66))","Validate len(scalar) == 66 before calling ScalarBaseMult","Double-check that you are using the correct curve — P-521 scalars are 66 bytes, not 32"],"exampleFix":"// before\np, err := point.ScalarBaseMult(k.Bytes()) // likely < 66 bytes\n\n// after\nscalar := make([]byte, 66)\nk.FillBytes(scalar)\np, err := point.ScalarBaseMult(scalar)","handlingStrategy":"validation","validationCode":"const p521ScalarLen = 66\n\nfunc validateP521Scalar(b []byte) error {\n    if len(b) != p521ScalarLen {\n        return fmt.Errorf(\"P-521 scalar must be %d bytes, got %d\", p521ScalarLen, len(b))\n    }\n    return nil\n}\n\nif err := validateP521Scalar(scalar); err != nil { return err }\np, err := point.ScalarBaseMult(scalar)","typeGuard":null,"tryCatchPattern":"p, err := point.ScalarBaseMult(scalar)\nif err != nil {\n    return fmt.Errorf(\"P-521 ScalarBaseMult failed: %w\", err)\n}","preventionTips":["P-521 scalars are 66 bytes (521 bits), not 32 — double-check the curve","Use big.Int.FillBytes(make([]byte, 66)) for fixed-width encoding","Keep curve selection centralized in configuration to avoid P-256/P-521 confusion"],"tags":["crypto","fips140","p521","scalar","input-validation","scalar-multiplication"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}