golang/go · error

mldsa: invalid signature

Error message

mldsa: invalid signature

What it means

After the signature passes its length check, ML-DSA decodes the response vector z and rejects any coefficient that lies outside the allowed bound (|z| < γ1 - β for the parameter set). errInvalidSignatureCoeffBounds is a strong signal: the bytes parsed cleanly but the signature is structurally invalid. In practice this means the signature is corrupted, truncated mid-field, belongs to a different key, or was tampered with.

Source

Thrown at src/crypto/internal/fips140/mldsa/mldsa.go:626

				return true
			}
		}
	case 88:
		for i := range w {
			_, r0 := decompose88(w[i])
			if constantTimeAbs(r0) >= bound {
				return true
			}
		}
	default:
		panic("mldsa: internal error: unsupported γ2")
	}
	return false
}

var (
	errInvalidSignatureLength           = errors.New("mldsa: invalid signature length")
	errInvalidSignatureCoeffBounds      = errors.New("mldsa: invalid signature")
	errInvalidSignatureChallenge        = errors.New("mldsa: invalid signature")
	errInvalidSignatureHintLimits       = errors.New("mldsa: invalid signature encoding")
	errInvalidSignatureHintIndexOrder   = errors.New("mldsa: invalid signature encoding")
	errInvalidSignatureHintExtraIndices = errors.New("mldsa: invalid signature encoding")
)

func Verify(pub *PublicKey, msg, sig []byte, context string) error {
	fipsSelfTest()
	fips140.RecordApproved()
	μ, err := computeMessageHash(pub.tr[:], msg, context)
	if err != nil {
		return err
	}
	return verifyInternal(pub, &μ, sig)
}

func VerifyExternalMu(pub *PublicKey, μ []byte, sig []byte) error {
	fipsSelfTest()

View on GitHub (pinned to b6b368adc5)

Solutions

1. Treat as a verification failure: do not trust the message, surface a generic 'invalid signature' to the caller (avoid leaking which sub-check failed).
2. Re-check that the same context string and parameter set were used for Sign and Verify.
3. Re-transmit or re-sign from a known-good source; if it persists, audit the transport/storage layer for corruption.
4. If interop-testing, confirm the peer uses FIPS 204 (not the older Dilithium drafts) and the same γ1/β parameters.

Example fix

// before
if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {
    log.Printf("coeff bound: %v", err)   // leaks detail
}

// after
if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {
    return errors.New("signature verification failed")
}

if err := mldsa.Verify(pub, msg, sig, ctx); err != nil {
    // do not branch on the specific sub-error; treat all as verification failure
    return ErrSignatureInvalid
}

When it happens

Trigger: mldsa.Verify with a signature that has the right length but encodes at least one z-coefficient outside the γ1-β bound (corruption, wrong key, tampering, mismatched context).

Common situations: Bit flips in storage/transit; verifying a signature produced for a different public key or context string; signature produced by an incompatible (non-FIPS-204) implementation; partial overwrite of the byte buffer.

Related errors

• mldsa: invalid signature encoding
• mldsa: coefficient out of range
• mlkem: invalid polynomial encoding
• ecdsa: public key does not match curve
• ecdsa: invalid signature: r is zero

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/d85e246f83d8a18c. Report an issue: GitHub.