golang/go · error

invalid key size

Error message

invalid key size

What it means

Thrown by aead.aead (hpke/aead.go:92) when the supplied key length does not equal the algorithm's nK (key size) — e.g. 16 bytes for AES-128-GCM, 32 for AES-256-GCM/ChaCha20Poly1305. HPKE AEADs require an exact key length; a mismatch means the KEM/Schedule produced wrong-length key material or the caller passed the wrong bytes.

Source

Thrown at src/crypto/hpke/aead.go:92

	nN:  96 / 8,
	new: newAESGCM,
	id:  0x0002,
}

var chacha20poly1305AEAD = &aead{
	nK:  chacha20poly1305.KeySize,
	nN:  chacha20poly1305.NonceSize,
	new: chacha20poly1305.New,
	id:  0x0003,
}

func (a *aead) ID() uint16 {
	return a.id
}

func (a *aead) aead(key []byte) (cipher.AEAD, error) {
	if len(key) != a.nK {
		return nil, errors.New("invalid key size")
	}
	return a.new(key)
}

func (a *aead) keySize() int {
	return a.nK
}

func (a *aead) nonceSize() int {
	return a.nN
}

type exportOnlyAEAD struct{}

func (exportOnlyAEAD) ID() uint16 {
	return 0xFFFF
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Confirm the key length matches the AEAD: 16 bytes (AES-128-GCM), 32 bytes (AES-256-GCM, ChaCha20Poly1305).
2. Use the HPKE Sender/Receiver API which derives correctly-sized keys via the KDF rather than constructing the AEAD directly.
3. Validate len(key) == aead.keySize() before instantiating the AEAD.

Example fix

// before
key := []byte("16-byte-key----") // 16 bytes for AES-256-GCM -> error 259
cekaead, err := aead.aead(key) // nK=32

// after
key := make([]byte, chacha20poly1305.KeySize) // 32 bytes
cekaead, err := chacha20poly1305.New(key)

if len(key) != expectedKeySize {
    return fmt.Errorf("key must be %d bytes, got %d", expectedKeySize, len(key))
}

func correctAEADKeySize(suiteID uint16, key []byte) bool {
    switch suiteID {
    case 0x0001: return len(key) == 16 // AES-128-GCM
    case 0x0002: return len(key) == 32 // AES-256-GCM
    case 0x0003: return len(key) == 32 // ChaCha20Poly1305
    }
    return false
}

When it happens

Trigger: Reached via the HPKE suite when the AEAD is instantiated with a key whose length != nK. Happens if the HPKE Export/Setup produced a truncated key, if a custom AEAD key size is misconfigured, or if the caller feeds an arbitrary-length secret directly as the AEAD key.

Common situations: Mismatch between the KDF output length and the AEAD key size; hard-coding a 128-bit key with a 256-bit AEAD (or vice versa); deserializing key material at the wrong length.

Related errors

• cipher: message authentication failed
• crypto/dsa: invalid public key
• crypto/dsa: invalid ParameterSizes
• crypto/dsa: parameters not set up before generating key
• crypto/ecdh: private key and public key curves do not match

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f24b1bf065ae7c1f. Report an issue: GitHub.