mlkemtest: Encapsulate1024: random must be 32 bytes

Error message

mlkemtest: Encapsulate1024: random must be 32 bytes

What it means

Returned by mlkemtest.Encapsulate1024 (the ML-KEM-1024 derandomized KAT helper) when the randomness slice is not exactly 32 bytes. Identical contract to Encapsulate768: FIPS 203 derandomized encapsulation requires a 32-byte seed. The function is test-only.

Source

Thrown at src/crypto/mlkem/mlkemtest/mlkemtest.go:42

	if fips140only.Enforced() {
		return nil, nil, errors.New("crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode")
	}
	k, err := fips140mlkem.NewEncapsulationKey768(ek.Bytes())
	if err != nil {
		return nil, nil, errors.New("mlkemtest: Encapsulate768: failed to reconstruct key: " + err.Error())
	}
	sharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))
	return sharedKey, ciphertext, nil
}

// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation
// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key
// ek and 32 bytes of randomness.
//
// It must only be used for known-answer tests.
func Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {
	if len(random) != 32 {
		return nil, nil, errors.New("mlkemtest: Encapsulate1024: random must be 32 bytes")
	}
	if fips140only.Enforced() {
		return nil, nil, errors.New("crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode")
	}
	k, err := fips140mlkem.NewEncapsulationKey1024(ek.Bytes())
	if err != nil {
		return nil, nil, errors.New("mlkemtest: Encapsulate1024: failed to reconstruct key: " + err.Error())
	}
	sharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))
	return sharedKey, ciphertext, nil
}

View on GitHub (pinned to b6b368adc5)

Solutions

Provide exactly 32 bytes: z := make([]byte, 32); crypto/rand.Read(z).
Validate len(random)==32 before calling, returning a clear caller error.
Use ek.Encapsulate() for production randomized encapsulation.

Example fix

// before
shared, ct, err := mlkemtest.Encapsulate1024(ek, z16) // wrong size

// after
z := make([]byte, 32)
rand.Read(z)
shared, ct, err := mlkemtest.Encapsulate1024(ek, z)

Defensive patterns

Strategy: validation

Validate before calling

if len(random) != 32 {
    return nil, nil, fmt.Errorf("random must be 32 bytes, got %d", len(random))
}
return mlkemtest.Encapsulate1024(ek, random)

Type guard

func isValidSeed(b []byte) bool { return len(b) == 32 }

Try / catch

shared, ct, err := mlkemtest.Encapsulate1024(ek, random)
if err != nil && strings.Contains(err.Error(), "random must be 32 bytes") {
    random = make([]byte, 32)
    rand.Read(random)
    shared, ct, err = mlkemtest.Encapsulate1024(ek, random)
}
return shared, ct, err

Prevention

Use a [32]byte typed variable to make the size compile-time checked.
Keep 768 and 1024 seed generation in one helper to avoid copy errors.
Use ek.Encapsulate() for production randomized encapsulation.

When it happens

Trigger: Calling Encapsulate1024(ek, random) with a slice whose length is not 32. Reusing a buffer sized for a different scheme.

Common situations: Porting 768 test code to 1024 but keeping a wrong-sized buffer. Passing a hex-decoded value of wrong length.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/8829225d3d2f6639. Report an issue: GitHub.