golang/go · error

mlkem: invalid secret key encoding

Error message

mlkem: invalid secret key encoding

What it means

Thrown by TestingOnlyNewDecapsulationKey1024 when polyByteDecode fails while parsing one of the k=2 secret polynomial shares (s[i]) from the NIST expanded decapsulation-key byte blob. Each share must decode as a valid 12-bit-per-coefficient NTT element occupying exactly encodingSize12 bytes. ACVP-only constructor; not for production use.

Source

Thrown at src/crypto/internal/fips140/mlkem/mlkem1024.go:172

// TestingOnlyNewDecapsulationKey1024 parses a decapsulation key from its expanded NIST format.
//
// Bytes() must not be called on the returned key, as it will not produce the
// original seed.
//
// This function should only be used for ACVP testing. Prefer NewDecapsulationKey1024 for all
// other purposes.
func TestingOnlyNewDecapsulationKey1024(b []byte) (*DecapsulationKey1024, error) {
	if len(b) != decapsulationKeySize1024 {
		return nil, errors.New("mlkem: invalid NIST decapsulation key length")
	}

	dk := &DecapsulationKey1024{}
	for i := range dk.s {
		var err error
		dk.s[i], err = polyByteDecode[nttElement](b[:encodingSize12])
		if err != nil {
			return nil, errors.New("mlkem: invalid secret key encoding")
		}
		b = b[encodingSize12:]
	}

	ek, err := NewEncapsulationKey1024(b[:EncapsulationKeySize1024])
	if err != nil {
		return nil, err
	}
	dk.ρ = ek.ρ
	dk.h = ek.h
	dk.encryptionKey1024 = ek.encryptionKey1024
	b = b[EncapsulationKeySize1024:]

	if !bytes.Equal(dk.h[:], b[:32]) {
		return nil, errors.New("mlkem: inconsistent H(ek) in encoded bytes")
	}
	b = b[32:]

View on GitHub (pinned to b6b368adc5)

Solutions

  1. Verify the input blob is exactly decapsulationKeySize1024 bytes and was generated for ML-KEM-1024 (not 768).
  2. Confirm each 12-bit coefficient block encodes values in [0, 3328]; reject any blob sourced from a non-ACVP generator.
  3. Use NewDecapsulationKey1024(seed) with a 64-byte d||z seed instead of the NIST-expanded form unless you are running ACVP conformance tests.
  4. Regenerate the vector from a known-good ACVP test vector set matching FIPS 203 final.

Example fix

// before
dk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(blob) // blob mis-labeled
// after
if len(blob) != mlkem1024.DecapsulationKeySize1024() {
    return fmt.Errorf("blob is %d bytes, want %d", len(blob), mlkem1024.DecapsulationKeySize1024())
}
dk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(blob)
Defensive patterns

Strategy: validation

Validate before calling

// Verify blob length for ML-KEM-1024 NIST format; rely on constructor for coefficient decode.
if len(b) != mlkem1024.DecapsulationKeySize1024() {
    return fmt.Errorf("len %d != %d", len(b), mlkem1024.DecapsulationKeySize1024())
}
dk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(b)
if err != nil { return fmt.Errorf("malformed ACVP vector: %w", err) }

Type guard

func isLikelyMLKEM1024Blob(b []byte) bool {
    return len(b) == mlkem1024.DecapsulationKeySize1024()
}

Try / catch

dk, err := mlkem1024.TestingOnlyNewDecapsulationKey1024(b)
if err != nil {
    return fmt.Errorf("ACVP vector rejected (param=1024, len=%d): %w", len(b), err)
}

Prevention

When it happens

Trigger: Calling TestingOnlyNewDecapsulationKey1024 with a byte slice whose total length is decapsulationKeySize1024 but whose s-vector region contains coefficients outside the valid 12-bit range (e.g. values >= q=3329) or malformed 12-bit packed bytes. A wrong-length slice is caught earlier (error 380 vs 381 boundary); this fires only after the length gate passes but a coefficient decode fails.

Common situations: Feeding an ACVP vector with the wrong byte ordering, using a blob generated for ML-KEM-768 instead of 1024, truncating/corrupting test vectors, or reusing a vector from an older FIPS 203 draft whose serialization changed.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/6f2cac614802f8c0. Report an issue: GitHub.