golang/go · error

mldsa: invalid signature encoding

Error message

mldsa: invalid signature encoding

What it means

ML-DSA signatures carry a hint vector h used during verification to correct rounding; FIPS 204 limits the total number of hint entries per parameter set (Ω = 80/55/75 for 44/65/87). errInvalidSignatureHintLimits is raised when a decoded signature exceeds that quota, meaning the hint region is structurally invalid. To a caller it is indistinguishable from any other verification failure.

Source

Thrown at src/crypto/internal/fips140/mldsa/mldsa.go:628

		}
	case 88:
		for i := range w {
			_, r0 := decompose88(w[i])
			if constantTimeAbs(r0) >= bound {
				return true
			}
		}
	default:
		panic("mldsa: internal error: unsupported γ2")
	}
	return false
}

var (
	errInvalidSignatureLength           = errors.New("mldsa: invalid signature length")
	errInvalidSignatureCoeffBounds      = errors.New("mldsa: invalid signature")
	errInvalidSignatureChallenge        = errors.New("mldsa: invalid signature")
	errInvalidSignatureHintLimits       = errors.New("mldsa: invalid signature encoding")
	errInvalidSignatureHintIndexOrder   = errors.New("mldsa: invalid signature encoding")
	errInvalidSignatureHintExtraIndices = errors.New("mldsa: invalid signature encoding")
)

func Verify(pub *PublicKey, msg, sig []byte, context string) error {
	fipsSelfTest()
	fips140.RecordApproved()
	μ, err := computeMessageHash(pub.tr[:], msg, context)
	if err != nil {
		return err
	}
	return verifyInternal(pub, &μ, sig)
}

func VerifyExternalMu(pub *PublicKey, μ []byte, sig []byte) error {
	fipsSelfTest()
	fips140.RecordApproved()
	if len(μ) != 64 {

View on GitHub (pinned to b6b368adc5)

Solutions

1. Surface a generic verification-failure to the caller without distinguishing the hint sub-check.
2. Re-sign from the original signer; if the failure follows a specific signer, audit its FIPS 204 conformance.
3. Ensure the message/key/context used in Verify byte-match those used in Sign.

Example fix

// before
if errors.Is(err, errInvalidSignatureHintLimits) { retry() }  // wrong reflex

// after
if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {
    return ErrSignatureInvalid
}

if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {
    return ErrSignatureInvalid
}

When it happens

Trigger: mldsa.Verify on a right-length signature whose hint region encodes more than Ω set bits (corruption, tampering, wrong implementation).

Common situations: Bit flips concentrated in the hint region; signature produced by a buggy/non-conformant signer that over-issues hints; cross-variant byte mixing.

Related errors

• mldsa: invalid signature
• mldsa: coefficient out of range
• mlkem: invalid polynomial encoding
• ecdsa: public key does not match curve
• ecdsa: invalid signature: r is zero

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/9fe23733b0a9e533. Report an issue: GitHub.