golang/go · error

mlkemtest: Encapsulate768: failed to reconstruct key:

Error message

mlkemtest: Encapsulate768: failed to reconstruct key: 

What it means

Returned by mlkemtest.Encapsulate768 when reconstructing the internal FIPS encapsulation key from ek.Bytes() fails. The inner call fips140mlkem.NewEncapsulationKey768 returns an error if the byte encoding is malformed, truncated, or fails the module's key-format validation; this wrapper prepends a descriptive prefix and re-throws. It indicates the EncapsulationKey768 passed in is structurally invalid.

Source

Thrown at src/crypto/mlkem/mlkemtest/mlkemtest.go:29

	"crypto/mlkem"
	"errors"
)

// Encapsulate768 implements derandomized ML-KEM-768 encapsulation
// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key
// ek and 32 bytes of randomness.
//
// It must only be used for known-answer tests.
func Encapsulate768(ek *mlkem.EncapsulationKey768, random []byte) (sharedKey, ciphertext []byte, err error) {
	if len(random) != 32 {
		return nil, nil, errors.New("mlkemtest: Encapsulate768: random must be 32 bytes")
	}
	if fips140only.Enforced() {
		return nil, nil, errors.New("crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode")
	}
	k, err := fips140mlkem.NewEncapsulationKey768(ek.Bytes())
	if err != nil {
		return nil, nil, errors.New("mlkemtest: Encapsulate768: failed to reconstruct key: " + err.Error())
	}
	sharedKey, ciphertext = k.EncapsulateInternal((*[32]byte)(random))
	return sharedKey, ciphertext, nil
}

// Encapsulate1024 implements derandomized ML-KEM-1024 encapsulation
// (ML-KEM.Encaps_internal from FIPS 203) using the provided encapsulation key
// ek and 32 bytes of randomness.
//
// It must only be used for known-answer tests.
func Encapsulate1024(ek *mlkem.EncapsulationKey1024, random []byte) (sharedKey, ciphertext []byte, err error) {
	if len(random) != 32 {
		return nil, nil, errors.New("mlkemtest: Encapsulate1024: random must be 32 bytes")
	}
	if fips140only.Enforced() {
		return nil, nil, errors.New("crypto/mlkem/mlkemtest: use of derandomized encapsulation is not allowed in FIPS 140-only mode")
	}
	k, err := fips140mlkem.NewEncapsulationKey1024(ek.Bytes())

View on GitHub (pinned to b6b368adc5)

Solutions

1. Validate the source key first: ensure ek was produced by NewEncapsulationKey768(bytes) with a checked error.
2. Verify byte length matches ML-KEM-768 encapsulation key size (1184 bytes) before reconstruction.
3. Regenerate or re-fetch the key material if it fails.

Example fix

// before
var ek *mlkem.EncapsulationKey768 // not properly initialized
shared, ct, err := mlkemtest.Encapsulate768(ek, z) // reconstruct fails

// after
if len(raw) != 1184 { return fmt.Errorf("bad ek length") }
ek, err := mlkem.NewEncapsulationKey768(raw)
if err != nil { return err }
shared, ct, err := mlkemtest.Encapsulate768(ek, z)

// Validate the encapsulation key bytes before calling the helper.
if len(ek.Bytes()) != 1184 {
    return nil, nil, fmt.Errorf("invalid ML-KEM-768 ek length")
}
return mlkemtest.Encapsulate768(ek, random)

func isValidEk768(ek *mlkem.EncapsulationKey768) bool {
    return ek != nil && len(ek.Bytes()) == 1184
}

shared, ct, err := mlkemtest.Encapsulate768(ek, random)
if err != nil && strings.Contains(err.Error(), "failed to reconstruct key") {
    ek, err = mlkem.NewEncapsulationKey768(rawSrc)
    if err != nil { return nil, nil, err }
    shared, ct, err = mlkemtest.Encapsulate768(ek, random)
}
return shared, ct, err

When it happens

Trigger: Passing an EncapsulationKey768 that was built from corrupted/truncated bytes. Using a key object that was never properly initialized (ek.Bytes() returns empty/garbage). Feeding a 1024 key's bytes into a 768 context.

Common situations: Loading an encapsulation key from an untrusted source without prior validation. Test vectors loaded with wrong endianness or length. Key bytes corrupted in transit/storage.

Related errors

• mlkemtest: Encapsulate1024: failed to reconstruct key:
• mlkemtest: Encapsulate768: random must be 32 bytes
• crypto/mlkem/mlkemtest: use of derandomized encapsulation is
• mlkemtest: Encapsulate1024: random must be 32 bytes
• mldsa: invalid SignerOpts

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/3006823db884e8fd. Report an issue: GitHub.