mlkemtest: Encapsulate1024: failed to reconstruct key:

Error message

mlkemtest: Encapsulate1024: failed to reconstruct key:

What it means

Returned by mlkemtest.Encapsulate1024 when fips140mlkem.NewEncapsulationKey1024(ek.Bytes()) fails to reconstruct the internal key. The bytes are malformed, truncated, or fail ML-KEM-1024 key-format validation (expected 1568-byte encapsulation key). The wrapper prepends a prefix and re-throws the inner error.

Source

Thrown at src/crypto/mlkem/mlkemtest/mlkemtest.go:49

	sharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))
	return sharedKey, ciphertext, nil
}

// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation
// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key
// ek and 32 bytes of randomness.
//
// It must only be used for known-answer tests.
func Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {
	if len(random) != 32 {
		return nil, nil, errors.New("mlkemtest: Encapsulate1024: random must be 32 bytes")
	}
	if fips140only.Enforced() {
		return nil, nil, errors.New("crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode")
	}
	k, err := fips140mlkem.NewEncapsulationKey1024(ek.Bytes())
	if err != nil {
		return nil, nil, errors.New("mlkemtest: Encapsulate1024: failed to reconstruct key: " + err.Error())
	}
	sharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))
	return sharedKey, ciphertext, nil
}

View on GitHub (pinned to b6b368adc5)

Solutions

Verify byte length is 1568 (ML-KEM-1024 ek size) before use.
Construct the key via mlkem.NewEncapsulationKey1024(raw) and check the error.
Regenerate key material if reconstruction consistently fails.

Example fix

// before
ek := &mlkem.EncapsulationKey1024{} // zero value
shared, ct, err := mlkemtest.Encapsulate1024(ek, z) // reconstruct fails

// after
if len(raw) != 1568 { return fmt.Errorf("bad ek length") }
ek, err := mlkem.NewEncapsulationKey1024(raw)
if err != nil { return err }
shared, ct, err := mlkemtest.Encapsulate1024(ek, z)

Defensive patterns

Strategy: try-catch

Validate before calling

if len(ek.Bytes()) != 1568 {
    return nil, nil, fmt.Errorf("invalid ML-KEM-1024 ek length")
}
return mlkemtest.Encapsulate1024(ek, random)

Type guard

func isValidEk1024(ek *mlkem.EncapsulationKey1024) bool {
    return ek != nil && len(ek.Bytes()) == 1568
}

Try / catch

shared, ct, err := mlkemtest.Encapsulate1024(ek, random)
if err != nil && strings.Contains(err.Error(), "failed to reconstruct key") {
    ek, err = mlkem.NewEncapsulationKey1024(rawSrc)
    if err != nil { return nil, nil, err }
    shared, ct, err = mlkemtest.Encapsulate1024(ek, random)
}
return shared, ct, err

Prevention

Construct ek via mlkem.NewEncapsulationKey1024 and check the error.
Validate byte length (1568) before calling the test helper.
Keep 768/1024 key-length constants in a shared config to prevent mix-ups.

When it happens

Trigger: Passing an EncapsulationKey1024 whose Bytes() are corrupt or empty. Feeding 768 key bytes into a 1024 reconstruction path. Key material damaged in storage/transit.

Common situations: Deserializing keys from an untrusted blob without length checks. Misconfigured key management returning the wrong key type. Test vectors with copy/paste errors.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/490a11b9ae95ac49. Report an issue: GitHub.