{"record":{"id":"f24b1bf065ae7c1f","repo":"golang/go","slug":"invalid-key-size","errorCode":null,"errorMessage":"invalid key size","messagePattern":"invalid key size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/hpke/aead.go","lineNumber":92,"sourceCode":"\tnN:  96 / 8,\n\tnew: newAESGCM,\n\tid:  0x0002,\n}\n\nvar chacha20poly1305AEAD = &aead{\n\tnK:  chacha20poly1305.KeySize,\n\tnN:  chacha20poly1305.NonceSize,\n\tnew: chacha20poly1305.New,\n\tid:  0x0003,\n}\n\nfunc (a *aead) ID() uint16 {\n\treturn a.id\n}\n\nfunc (a *aead) aead(key []byte) (cipher.AEAD, error) {\n\tif len(key) != a.nK {\n\t\treturn nil, errors.New(\"invalid key size\")\n\t}\n\treturn a.new(key)\n}\n\nfunc (a *aead) keySize() int {\n\treturn a.nK\n}\n\nfunc (a *aead) nonceSize() int {\n\treturn a.nN\n}\n\ntype exportOnlyAEAD struct{}\n\nfunc (exportOnlyAEAD) ID() uint16 {\n\treturn 0xFFFF\n}\n","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/hpke/aead.go#L74-L110","documentation":"Thrown by aead.aead (hpke/aead.go:92) when the supplied key length does not equal the algorithm's nK (key size) — e.g. 16 bytes for AES-128-GCM, 32 for AES-256-GCM/ChaCha20Poly1305. HPKE AEADs require an exact key length; a mismatch means the KEM/Schedule produced wrong-length key material or the caller passed the wrong bytes.","triggerScenarios":"Reached via the HPKE suite when the AEAD is instantiated with a key whose length != nK. Happens if the HPKE Export/Setup produced a truncated key, if a custom AEAD key size is misconfigured, or if the caller feeds an arbitrary-length secret directly as the AEAD key.","commonSituations":"Mismatch between the KDF output length and the AEAD key size; hard-coding a 128-bit key with a 256-bit AEAD (or vice versa); deserializing key material at the wrong length.","solutions":["Confirm the key length matches the AEAD: 16 bytes (AES-128-GCM), 32 bytes (AES-256-GCM, ChaCha20Poly1305).","Use the HPKE Sender/Receiver API which derives correctly-sized keys via the KDF rather than constructing the AEAD directly.","Validate len(key) == aead.keySize() before instantiating the AEAD."],"exampleFix":"// before\nkey := []byte(\"16-byte-key----\") // 16 bytes for AES-256-GCM -> error 259\ncekaead, err := aead.aead(key) // nK=32\n\n// after\nkey := make([]byte, chacha20poly1305.KeySize) // 32 bytes\ncekaead, err := chacha20poly1305.New(key)","handlingStrategy":"validation","validationCode":"if len(key) != expectedKeySize {\n    return fmt.Errorf(\"key must be %d bytes, got %d\", expectedKeySize, len(key))\n}","typeGuard":"func correctAEADKeySize(suiteID uint16, key []byte) bool {\n    switch suiteID {\n    case 0x0001: return len(key) == 16 // AES-128-GCM\n    case 0x0002: return len(key) == 32 // AES-256-GCM\n    case 0x0003: return len(key) == 32 // ChaCha20Poly1305\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Let the HPKE Sender/Receiver derive the AEAD key via the KDF rather than constructing it directly.","Match key length to the AEAD: 16 (AES-128-GCM), 32 (AES-256-GCM, ChaCha20Poly1305).","Validate len(key) before instantiating the AEAD."],"tags":["go","crypto","hpke","aead","validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}