golang/go · error

mlkem: invalid encapsulation key length

Error message

mlkem: invalid encapsulation key length

What it means

Thrown by parseEK (via NewEncapsulationKey768) when the encapsulation-key byte slice length is not exactly EncapsulationKeySize768. 768 analogue of error 382.

Source

Thrown at src/crypto/internal/fips140/mlkem/mlkem768.go:386

	c = pkeEncrypt(cc, &ek.encryptionKey, m, r)
	return K, c
}

// NewEncapsulationKey768 parses an encapsulation key from its encoded form.
// If the encapsulation key is not valid, NewEncapsulationKey768 returns an error.
func NewEncapsulationKey768(encapsulationKey []byte) (*EncapsulationKey768, error) {
	// The actual logic is in a separate function to outline this allocation.
	ek := &EncapsulationKey768{}
	return parseEK(ek, encapsulationKey)
}

// parseEK parses an encryption key from its encoded form.
//
// It implements the initial stages of K-PKE.Encrypt according to FIPS 203,
// Algorithm 14.
func parseEK(ek *EncapsulationKey768, ekPKE []byte) (*EncapsulationKey768, error) {
	if len(ekPKE) != EncapsulationKeySize768 {
		return nil, errors.New("mlkem: invalid encapsulation key length")
	}

	h := sha3.New256()
	h.Write(ekPKE)
	h.Sum(ek.h[:0])

	for i := range ek.t {
		var err error
		ek.t[i], err = polyByteDecode[nttElement](ekPKE[:encodingSize12])
		if err != nil {
			return nil, err
		}
		ekPKE = ekPKE[encodingSize12:]
	}
	copy(ek.ρ[:], ekPKE)

	for i := byte(0); i < k; i++ {
		for j := byte(0); j < k; j++ {

View on GitHub (pinned to b6b368adc5)

Solutions

1. Assert len(encapsulationKey) == EncapsulationKeySize768 before calling.
2. Strip PEM/DER/base64 wrappers; pass raw ML-KEM-768 bytes.
3. Dispatch on algorithm identifier before selecting the 768 constructor.
4. Regenerate the key with the current library to rule out format drift.

Example fix

// before
ek, err := mlkem768.NewEncapsulationKey768(pub) // pub is 1024-size
// after
if len(pub) != mlkem768.EncapsulationKeySize768 {
    return fmt.Errorf("pub len %d != %d", len(pub), mlkem768.EncapsulationKeySize768)
}
ek, err := mlkem768.NewEncapsulationKey768(pub)

if len(ek) != mlkem768.EncapsulationKeySize768 {
    return fmt.Errorf("encapsulation key len %d != %d", len(ek), mlkem768.EncapsulationKeySize768)
}

func isMLKEM768EncapsulationKey(b []byte) bool {
    return len(b) == mlkem768.EncapsulationKeySize768
}

ek, err := mlkem768.NewEncapsulationKey768(pub)
if err != nil {
    return fmt.Errorf("invalid ML-KEM-768 encapsulation key (len=%d): %w", len(pub), err)
}

When it happens

Trigger: Passing a 1024-size public key, an un-decoded base64/hex string, a PEM/DER-wrapped key, or a truncated buffer.

Common situations: Hard-coding the 1024 size for a 768 key, forgetting to strip SPKI wrapping, dispatch failure on a multi-algorithm key store, or version drift in EncapsulationKeySize768.

Related errors

• mlkem: invalid encapsulation key length
• mlkem: invalid NIST decapsulation key length
• mlkem: invalid secret key encoding
• mlkem: inconsistent H(ek) in encoded bytes
• mlkem: invalid ciphertext length

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/116773d2694fe429. Report an issue: GitHub.