{"record":{"id":"f259bf9facdcb6da","repo":"golang/go","slug":"mldsa-coefficient-out-of-range","errorCode":null,"errorMessage":"mldsa: coefficient out of range","messagePattern":"mldsa: coefficient out of range","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/mldsa/semiexpanded.go","lineNumber":236,"sourceCode":"\tmask := uint32((1 << bitlen) - 1)\n\tmaxValue := uint32(a + b)\n\n\tvar r ringElement\n\tvar acc uint32\n\tvar accBits uint\n\tvIdx := 0\n\n\tfor i := range r {\n\t\tfor accBits < uint(bitlen) {\n\t\t\tif vIdx < len(v) {\n\t\t\t\tacc |= uint32(v[vIdx]) << accBits\n\t\t\t\tvIdx++\n\t\t\t\taccBits += 8\n\t\t\t}\n\t\t}\n\t\tw := acc & mask\n\t\tif w > maxValue {\n\t\t\treturn ringElement{}, errors.New(\"mldsa: coefficient out of range\")\n\t\t}\n\t\tr[i] = fieldSubToMontgomery(uint32(b), w)\n\t\tacc >>= bitlen\n\t\taccBits -= uint(bitlen)\n\t}\n\n\treturn r, nil\n}\n","sourceCodeStart":218,"sourceCodeEnd":245,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/mldsa/semiexpanded.go#L218-L245","documentation":"While bit-unpacking a region, each decoded word is masked down to bitlen bits and compared against maxValue = a+b. A word exceeding that value means the packed bits encode an out-of-range coefficient (e.g. a non-canonical encoding of a secret polynomial), and 'coefficient out of range' is returned. For s1/s2/t0 this indicates the encoded value is not in the expected signed range after centering.","triggerScenarios":"bitUnpackSlow decodes a word w > a+b in an s1/s2/t0 region of a semi-expanded key, i.e. a non-canonical or corrupted coefficient.","commonSituations":"A blob that is the right length but contains non-canonical coefficient encodings; corruption inside a region; vectors produced by an implementation that does not range-reduce coefficients.","solutions":["Regenerate the semi-expanded bytes from a key produced by NewPrivateKey* (the library always emits canonical encodings).","Use untouched NIST/ACVP vectors that guarantee canonical encodings.","If you must transform coefficients, re-encode through bitPackSlow so values stay in range."],"exampleFix":"// before\npriv, err := mldsa.TestingOnlyNewPrivateKeyFromSemiExpanded(handEncoded)\n\n// after\nref, _ := mldsa.NewPrivateKey44(seed)\npriv, err := mldsa.TestingOnlyNewPrivateKeyFromSemiExpanded(\n    mldsa.TestingOnlyPrivateKeySemiExpandedBytes(ref))","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Regenerate semi-expanded bytes only through the library's canonical encoder.","Never hand-pack coefficients; always go through bitPackSlow.","Use canonical NIST/ACVP vectors."],"tags":["crypto","mldsa","fips","testing","integrity"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}