golang/go · error

mlkem: invalid NIST decapsulation key length

Error message

mlkem: invalid NIST decapsulation key length

What it means

TestingOnlyNewDecapsulationKey1024 parses the expanded NIST-format decapsulation key (the concatenation of s̄, the public key, the public key hash, and the implicit-rejection z). It requires exactly decapsulationKeySize1024 bytes; any other length yields 'invalid NIST decapsulation key length'. Like the mldsa TestingOnly helpers it is intended for ACVP conformance testing, not production use.

Solutions

1. Confirm the input is the expanded NIST form (typically produced/exported by ACVP tooling), not the 64-byte seed.
2. For production, use NewDecapsulationKey1024 with a 64-byte seed instead.
3. Round-trip test the blob against Bytes() to confirm size and contents line up.

Example fix

// before
dk, err := mlkem.TestingOnlyNewDecapsulationKey1024(seed[:])  // 64 bytes, wrong API

// after
dk, err := mlkem.NewDecapsulationKey1024(seed[:])
// or, for ACVP tests, pass the full expanded NIST blob of decapsulationKeySize1024 bytes

if len(b) != decapsulationKeySize1024 {
    return fmt.Errorf("NIST decapsulation key must be %d bytes", decapsulationKeySize1024)
}

func isExpandedNISTKey1024(b []byte) bool { return len(b) == decapsulationKeySize1024 }

When it happens

Trigger: Calling TestingOnlyNewDecapsulationKey1024(b) with a slice whose length is not decapsulationKeySize1024 (e.g. feeding the 64-byte seed form, or truncating the expanded blob).

Common situations: Passing a d||z seed to the testing-only parser; truncating/over-reading the NIST blob; using this test helper in production code paths.

Related errors

• mldsa: invalid input length for bitUnpackSlow
• mldsa: invalid semi-expanded private key size
• mlkem: invalid encoding length
• mlkem: invalid seed length
• mldsa: coefficient out of range

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/4938de953e27baf1. Report an issue: GitHub.

Appendix: source

Thrown at src/crypto/internal/fips140/mlkem/mlkem1024.go:164

		return nil, errors.New("mlkem: invalid seed length")
	}
	d := (*[32]byte)(seed[:32])
	z := (*[32]byte)(seed[32:])
	kemKeyGen1024(dk, d, z)
	fips140.RecordApproved()
	return dk, nil
}

// TestingOnlyNewDecapsulationKey1024 parses a decapsulation key from its expanded NIST format.
//
// Bytes() must not be called on the returned key, as it will not produce the
// original seed.
//
// This function should only be used for ACVP testing. Prefer NewDecapsulationKey1024 for all
// other purposes.
func TestingOnlyNewDecapsulationKey1024(b []byte) (*DecapsulationKey1024, error) {
	if len(b) != decapsulationKeySize1024 {
		return nil, errors.New("mlkem: invalid NIST decapsulation key length")
	}

	dk := &DecapsulationKey1024{}
	for i := range dk.s {
		var err error
		dk.s[i], err = polyByteDecode[nttElement](b[:encodingSize12])
		if err != nil {
			return nil, errors.New("mlkem: invalid secret key encoding")
		}
		b = b[encodingSize12:]
	}

	ek, err := NewEncapsulationKey1024(b[:EncapsulationKeySize1024])
	if err != nil {
		return nil, err
	}
	dk.ρ = ek.ρ
	dk.h = ek.h

View on GitHub (pinned to b6b368adc5)