golang/go · error

mlkem: invalid NIST decapsulation key length

Error message

mlkem: invalid NIST decapsulation key length

What it means

TestingOnlyNewDecapsulationKey1024 parses the expanded NIST-format decapsulation key (the concatenation of s̄, the public key, the public key hash, and the implicit-rejection z). It requires exactly decapsulationKeySize1024 bytes; any other length yields 'invalid NIST decapsulation key length'. Like the mldsa TestingOnly helpers it is intended for ACVP conformance testing, not production use.

Source

Thrown at src/crypto/internal/fips140/mlkem/mlkem1024.go:164

		return nil, errors.New("mlkem: invalid seed length")
	}
	d := (*[32]byte)(seed[:32])
	z := (*[32]byte)(seed[32:])
	kemKeyGen1024(dk, d, z)
	fips140.RecordApproved()
	return dk, nil
}

// TestingOnlyNewDecapsulationKey1024 parses a decapsulation key from its expanded NIST format.
//
// Bytes() must not be called on the returned key, as it will not produce the
// original seed.
//
// This function should only be used for ACVP testing. Prefer NewDecapsulationKey1024 for all
// other purposes.
func TestingOnlyNewDecapsulationKey1024(b []byte) (*DecapsulationKey1024, error) {
	if len(b) != decapsulationKeySize1024 {
		return nil, errors.New("mlkem: invalid NIST decapsulation key length")
	}

	dk := &DecapsulationKey1024{}
	for i := range dk.s {
		var err error
		dk.s[i], err = polyByteDecode[nttElement](b[:encodingSize12])
		if err != nil {
			return nil, errors.New("mlkem: invalid secret key encoding")
		}
		b = b[encodingSize12:]
	}

	ek, err := NewEncapsulationKey1024(b[:EncapsulationKeySize1024])
	if err != nil {
		return nil, err
	}
	dk.ρ = ek.ρ
	dk.h = ek.h

View on GitHub (pinned to b6b368adc5)

Solutions

1. Confirm the input is the expanded NIST form (typically produced/exported by ACVP tooling), not the 64-byte seed.
2. For production, use NewDecapsulationKey1024 with a 64-byte seed instead.
3. Round-trip test the blob against Bytes() to confirm size and contents line up.

Example fix

// before
dk, err := mlkem.TestingOnlyNewDecapsulationKey1024(seed[:])  // 64 bytes, wrong API

// after
dk, err := mlkem.NewDecapsulationKey1024(seed[:])
// or, for ACVP tests, pass the full expanded NIST blob of decapsulationKeySize1024 bytes

if len(b) != decapsulationKeySize1024 {
    return fmt.Errorf("NIST decapsulation key must be %d bytes", decapsulationKeySize1024)
}

func isExpandedNISTKey1024(b []byte) bool { return len(b) == decapsulationKeySize1024 }

When it happens

Trigger: Calling TestingOnlyNewDecapsulationKey1024(b) with a slice whose length is not decapsulationKeySize1024 (e.g. feeding the 64-byte seed form, or truncating the expanded blob).

Common situations: Passing a d||z seed to the testing-only parser; truncating/over-reading the NIST blob; using this test helper in production code paths.

Related errors

• mldsa: invalid semi-expanded private key size
• mldsa: invalid input length for bitUnpackSlow
• mlkem: invalid encoding length
• mlkem: invalid seed length
• mldsa: invalid seed length

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/4938de953e27baf1. Report an issue: GitHub.