golang/go · error

mldsa: coefficient out of range

Error message

mldsa: coefficient out of range

What it means

While bit-unpacking a region, each decoded word is masked down to bitlen bits and compared against maxValue = a+b. A word exceeding that value means the packed bits encode an out-of-range coefficient (e.g. a non-canonical encoding of a secret polynomial), and 'coefficient out of range' is returned. For s1/s2/t0 this indicates the encoded value is not in the expected signed range after centering.

Source

Thrown at src/crypto/internal/fips140/mldsa/semiexpanded.go:236

	mask := uint32((1 << bitlen) - 1)
	maxValue := uint32(a + b)

	var r ringElement
	var acc uint32
	var accBits uint
	vIdx := 0

	for i := range r {
		for accBits < uint(bitlen) {
			if vIdx < len(v) {
				acc |= uint32(v[vIdx]) << accBits
				vIdx++
				accBits += 8
			}
		}
		w := acc & mask
		if w > maxValue {
			return ringElement{}, errors.New("mldsa: coefficient out of range")
		}
		r[i] = fieldSubToMontgomery(uint32(b), w)
		acc >>= bitlen
		accBits -= uint(bitlen)
	}

	return r, nil
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Regenerate the semi-expanded bytes from a key produced by NewPrivateKey* (the library always emits canonical encodings).
2. Use untouched NIST/ACVP vectors that guarantee canonical encodings.
3. If you must transform coefficients, re-encode through bitPackSlow so values stay in range.

Example fix

// before
priv, err := mldsa.TestingOnlyNewPrivateKeyFromSemiExpanded(handEncoded)

// after
ref, _ := mldsa.NewPrivateKey44(seed)
priv, err := mldsa.TestingOnlyNewPrivateKeyFromSemiExpanded(
    mldsa.TestingOnlyPrivateKeySemiExpandedBytes(ref))

When it happens

Trigger: bitUnpackSlow decodes a word w > a+b in an s1/s2/t0 region of a semi-expanded key, i.e. a non-canonical or corrupted coefficient.

Common situations: A blob that is the right length but contains non-canonical coefficient encodings; corruption inside a region; vectors produced by an implementation that does not range-reduce coefficients.

Related errors

• mldsa: invalid signature
• mldsa: invalid signature encoding
• mldsa: invalid semi-expanded private key size
• mldsa: semi-expanded private key inconsistent with t0
• mldsa: semi-expanded private key inconsistent with public ke

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f259bf9facdcb6da. Report an issue: GitHub.