{"record":{"id":"d85e246f83d8a18c","repo":"golang/go","slug":"mldsa-invalid-signature","errorCode":null,"errorMessage":"mldsa: invalid signature","messagePattern":"mldsa: invalid signature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mldsa/mldsa.go","lineNumber":626,"sourceCode":"\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\tcase 88:\n\t\tfor i := range w {\n\t\t\t_, r0 := decompose88(w[i])\n\t\t\tif constantTimeAbs(r0) >= bound {\n\t\t\t\treturn true\n\t\t\t}\n\t\t}\n\tdefault:\n\t\tpanic(\"mldsa: internal error: unsupported γ2\")\n\t}\n\treturn false\n}\n\nvar (\n\terrInvalidSignatureLength           = errors.New(\"mldsa: invalid signature length\")\n\terrInvalidSignatureCoeffBounds      = errors.New(\"mldsa: invalid signature\")\n\terrInvalidSignatureChallenge        = errors.New(\"mldsa: invalid signature\")\n\terrInvalidSignatureHintLimits       = errors.New(\"mldsa: invalid signature encoding\")\n\terrInvalidSignatureHintIndexOrder   = errors.New(\"mldsa: invalid signature encoding\")\n\terrInvalidSignatureHintExtraIndices = errors.New(\"mldsa: invalid signature encoding\")\n)\n\nfunc Verify(pub *PublicKey, msg, sig []byte, context string) error {\n\tfipsSelfTest()\n\tfips140.RecordApproved()\n\tμ, err := computeMessageHash(pub.tr[:], msg, context)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn verifyInternal(pub, &μ, sig)\n}\n\nfunc VerifyExternalMu(pub *PublicKey, μ []byte, sig []byte) error {\n\tfipsSelfTest()","sourceCodeStart":608,"sourceCodeEnd":644,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mldsa/mldsa.go#L608-L644","documentation":"After the signature passes its length check, ML-DSA decodes the response vector z and rejects any coefficient that lies outside the allowed bound (|z| < γ1 - β for the parameter set). errInvalidSignatureCoeffBounds is a strong signal: the bytes parsed cleanly but the signature is structurally invalid. In practice this means the signature is corrupted, truncated mid-field, belongs to a different key, or was tampered with.","triggerScenarios":"mldsa.Verify with a signature that has the right length but encodes at least one z-coefficient outside the γ1-β bound (corruption, wrong key, tampering, mismatched context).","commonSituations":"Bit flips in storage/transit; verifying a signature produced for a different public key or context string; signature produced by an incompatible (non-FIPS-204) implementation; partial overwrite of the byte buffer.","solutions":["Treat as a verification failure: do not trust the message, surface a generic 'invalid signature' to the caller (avoid leaking which sub-check failed).","Re-check that the same context string and parameter set were used for Sign and Verify.","Re-transmit or re-sign from a known-good source; if it persists, audit the transport/storage layer for corruption.","If interop-testing, confirm the peer uses FIPS 204 (not the older Dilithium drafts) and the same γ1/β parameters."],"exampleFix":"// before\nif err := mldsa.Verify(pub, msg, sig, ctx); err != nil {\n    log.Printf(\"coeff bound: %v\", err)   // leaks detail\n}\n\n// after\nif err := mldsa.Verify(pub, msg, sig, ctx); err != nil {\n    return errors.New(\"signature verification failed\")\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {\n    // do not branch on the specific sub-error; treat all as verification failure\n    return ErrSignatureInvalid\n}","preventionTips":["Treat every post-length-check Verify error as a forgery; never retry with the same bytes.","Keep Sign and Verify on the same parameter set, context, and message bytes.","Wrap stored signatures in an integrity (checksum/AEAD) layer to catch corruption early."],"tags":["crypto","mldsa","fips","verification","integrity"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}