What causes "invalid PQ KEM for P-256 hybrid" in golang/go?

Pair P-256 only with *mlkem.EncapsulationKey768.

invalid PQ KEM for P-256 hybrid

Error message

invalid PQ KEM for P-256 hybrid

What it means

NewHybridPublicKey builds an ML-KEM + ECDH hybrid. For P-256 the only valid pairing is ML-KEM-768. If the pq argument is not *mlkem.EncapsulationKey768, the constructor rejects it. Same shape as the X25519/P-384 branches but for the P-256 combiner (ID 0x0050).

Source

Thrown at src/crypto/hpke/pq.go:151

//   - MLKEM1024-P384
//
// from draft-ietf-hpke-pq, depending on the underlying curve of t
// ([ecdh.X25519], [ecdh.P256], or [ecdh.P384]) and the type of pq (either
// *[mlkem.EncapsulationKey768] or *[mlkem.EncapsulationKey1024]).
//
// This function is meant for applications that already have instantiated
// crypto/ecdh and crypto/mlkem public keys. Otherwise, applications should use
// the [KEM.NewPublicKey] method of e.g. [MLKEM768X25519].
func NewHybridPublicKey(pq crypto.Encapsulator, t *ecdh.PublicKey) (PublicKey, error) {
	switch t.Curve() {
	case ecdh.X25519():
		if _, ok := pq.(*mlkem.EncapsulationKey768); !ok {
			return nil, errors.New("invalid PQ KEM for X25519 hybrid")
		}
		return &hybridPublicKey{mlkem768X25519, t, pq}, nil
	case ecdh.P256():
		if _, ok := pq.(*mlkem.EncapsulationKey768); !ok {
			return nil, errors.New("invalid PQ KEM for P-256 hybrid")
		}
		return &hybridPublicKey{mlkem768P256, t, pq}, nil
	case ecdh.P384():
		if _, ok := pq.(*mlkem.EncapsulationKey1024); !ok {
			return nil, errors.New("invalid PQ KEM for P-384 hybrid")
		}
		return &hybridPublicKey{mlkem1024P384, t, pq}, nil
	default:
		return nil, errors.New("unsupported curve")
	}
}

func (kem *hybridKEM) NewPublicKey(data []byte) (PublicKey, error) {
	if len(data) != kem.pqEncapsKeySize+kem.curvePointSize {
		return nil, errors.New("invalid public key size")
	}
	pq, err := kem.pqNewPublicKey(data[:kem.pqEncapsKeySize])
	if err != nil {

View on GitHub (pinned to b6b368adc5)

Solutions

Pair P-256 only with *mlkem.EncapsulationKey768.
Prefer MLKEM768P256().NewPublicKey(data) to parse both halves at once.
Add a compile-time type assertion in your wrapper to catch mismatches early.

Example fix

// before
pq, _ := mlkem.NewEncapsulationKey1024(pqBytes)
hpkePub, err := hpke.NewHybridPublicKey(pq, p256Pub) // "invalid PQ KEM for P-256 hybrid"

// after
pq, _ := mlkem.NewEncapsulationKey768(pqBytes)
hpkePub, err := hpke.NewHybridPublicKey(pq, p256Pub)

Defensive patterns

Strategy: type-guard

Validate before calling

func p256HybridPub(pq crypto.Encapsulator, t *ecdh.PublicKey) (hpke.PublicKey, error) {
    if _, ok := pq.(*mlkem.EncapsulationKey768); !ok {
        return nil, fmt.Errorf("P-256 hybrid requires *mlkem.EncapsulationKey768, got %T", pq)
    }
    return hpke.NewHybridPublicKey(pq, t)
}

Type guard

func isMLKEM768Encapsulator(pq crypto.Encapsulator) bool {
    _, ok := pq.(*mlkem.EncapsulationKey768)
    return ok
}

Try / catch

pub, err := hpke.NewHybridPublicKey(pq, p256Pub)
if err != nil && err.Error() == "invalid PQ KEM for P-256 hybrid" {
    return nil, fmt.Errorf("need *mlkem.EncapsulationKey768, got %T", pq)
}

Prevention

Keep a combiner-to-ML-KEM-size map and assert before constructing.
Use MLKEM768P256().NewPublicKey(blob) for parsing.
Add an integration test per combiner to lock the parameter set.

When it happens

Trigger: Calling hpke.NewHybridPublicKey(pq, p256Pub) with pq being *mlkem.EncapsulationKey1024 or any non-EncapsulationKey768 Encapsulator.

Common situations: Mismatching ML-KEM parameter sets across hybrid variants; using a 1024-bit ML-KEM key where the 768-bit variant is required.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/71d92ed97ff78a0e. Report an issue: GitHub.