{"record":{"id":"eae0857954206587","repo":"golang/go","slug":"invalid-scalar-length","errorCode":null,"errorMessage":"invalid scalar length","messagePattern":"invalid scalar length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/nistec/generate.go","lineNumber":548,"sourceCode":"\t\tfor i := 0; i < {{.p}}ElementLength*2; i++ {\n\t\t\t{{.p}}GeneratorTable[i][0] = New{{.P}}Point().Set(base)\n\t\t\tfor j := 1; j < 15; j++ {\n\t\t\t\t{{.p}}GeneratorTable[i][j] = New{{.P}}Point().Add({{.p}}GeneratorTable[i][j-1], base)\n\t\t\t}\n\t\t\tbase.Double(base)\n\t\t\tbase.Double(base)\n\t\t\tbase.Double(base)\n\t\t\tbase.Double(base)\n\t\t}\n\t})\n\treturn {{.p}}GeneratorTable\n}\n\n// ScalarBaseMult sets p = scalar * B, where B is the canonical generator, and\n// returns p.\nfunc (p *{{.P}}Point) ScalarBaseMult(scalar []byte) (*{{.P}}Point, error) {\n\tif len(scalar) != {{.p}}ElementLength {\n\t\treturn nil, errors.New(\"invalid scalar length\")\n\t}\n\ttables := p.generatorTable()\n\n\t// This is also a scalar multiplication with a four-bit window like in\n\t// ScalarMult, but in this case the doublings are precomputed. The value\n\t// [windowValue]G added at iteration k would normally get doubled\n\t// (totIterations-k)×4 times, but with a larger precomputation we can\n\t// instead add [2^((totIterations-k)×4)][windowValue]G and avoid the\n\t// doublings between iterations.\n\tt := New{{.P}}Point()\n\tp.Set(New{{.P}}Point())\n\ttableIndex := len(tables) - 1\n\tfor _, byte := range scalar {\n\t\twindowValue := byte >> 4\n\t\ttables[tableIndex].Select(t, windowValue)\n\t\tp.Add(p, t)\n\t\ttableIndex--\n","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/nistec/generate.go#L530-L566","documentation":"Generated from generate.go:548. Thrown by ScalarBaseMult when the scalar is not exactly ElementLength bytes for the curve. Fixed-size scalars are required by the constant-time comb implementation; variable-length scalars are not supported.","triggerScenarios":"Passing a 31-byte scalar to P-256 (expects 32), a big.Int.Bytes() output that dropped a leading zero, a hex string instead of raw bytes, or a scalar sized for a different curve.","commonSituations":"big.Int -> []byte via Bytes() (variable length) instead of FillBytes (fixed length), reusing a scalar across curves, or hash-truncated nonces that land short of ElementLength.","solutions":["Right-pad the scalar to ElementLength with FillBytes before calling ScalarBaseMult.","Reduce the scalar mod n where appropriate (note: ScalarBaseMult treats the input as fixed-size, not mod-reduced).","Confirm the byte slice is raw big-endian, not hex/base64.","Use the curve-matching scalar size constant rather than a hard-coded number."],"exampleFix":"// before\np, err := pt.ScalarBaseMult(k.Bytes()) // variable length\n// after\nbuf := make([]byte, p256ElementLength)\nif !k.FillBytes(buf) { return errors.New(\"scalar too large\") }\np, err := pt.ScalarBaseMult(buf)","handlingStrategy":"validation","validationCode":"// Right-pad the scalar to ElementLen with FillBytes.\nbuf := make([]byte, elementLength)\nif !k.FillBytes(buf) {\n    return errors.New(\"scalar too large\")\n}","typeGuard":"func isFixedLengthScalar(b []byte, elLen int) bool { return len(b) == elLen }","tryCatchPattern":"p, err := pt.ScalarBaseMult(scalar)\nif err != nil {\n    return fmt.Errorf(\"scalar rejected (len=%d): %w\", len(scalar), err)\n}","preventionTips":["Use big.Int.FillBytes (fixed size) instead of Bytes (variable size).","Pin the curve's ElementLen constant rather than hard-coding a number.","Decode hex/base64 into a fixed-length buffer before passing."],"tags":["elliptic-curve","fips140","crypto","nistec","scalar-multiplication","input-validation","code-generation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}