crypto/mldsa: Verify accepts uninitialized PublicKey with empty signature

[Cogsad]

Go version

go version go1.26.1 darwin/arm64

Reproduced against this golang/go checkout:

7132bcb37e51bac6e627013d7f0cedec9ec2d69e

Output of go env in your module/workspace

AR='ar'
CC='cc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='c++'
GCCGO='gccgo'
GO111MODULE='on'
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/private/var/folders/fc/r8tm09z92pz8sq4z3249bw2c0000gn/T/ptp-go-build-cache'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/r/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/fc/r8tm09z92pz8sq4z3249bw2c0000gn/T/go-build1621639486=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/r/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/r/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,off'
GOROOT='/private/var/folders/fc/r8tm09z92pz8sq4z3249bw2c0000gn/T/ptp-goroot.XRRCbV'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/r/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/private/var/folders/fc/r8tm09z92pz8sq4z3249bw2c0000gn/T/ptp-goroot.XRRCbV/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.26.1'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

I called crypto/mldsa.Verify with an uninitialized mldsa.PublicKey and an
empty signature.

Complete reproducer:

package main

import (
	"crypto/mldsa"
	"fmt"
)

func main() {
	var publicKey mldsa.PublicKey

	fmt.Printf("uninitialized PublicKey.Bytes length: %d\n", len(publicKey.Bytes()))
	fmt.Printf("approved public key lengths: %d, %d, %d\n",
		mldsa.MLDSA44PublicKeySize,
		mldsa.MLDSA65PublicKeySize,
		mldsa.MLDSA87PublicKeySize)

	err := mldsa.Verify(&publicKey, []byte("attacker-controlled message"), nil, nil)
	fmt.Printf("Verify returned: %v\n", err)
}

What did you see happen?

Verify returned nil.

The uninitialized public key does not appear to be a valid parameterized ML-DSA
public key. It serializes to 32 bytes, while the approved ML-DSA public key
encoding sizes are 1312, 1952, and 2592 bytes. It was created with
var publicKey mldsa.PublicKey; it is not an all-zero encoded ML-DSA public key
imported with NewPublicKey.

Observed output:

uninitialized PublicKey.Bytes length: 32
approved public key lengths: 1312, 1952, 2592
Verify returned: <nil>

The same uninitialized key also panics through PublicKey.Parameters() with:

mldsa: internal error: unknown parameters

So the implementation does not consistently treat this key as a valid approved
ML-DSA public key state, but Verify still accepts it when the signature is
empty.

What did you expect to see?

I expected Verify to reject an uninitialized mldsa.PublicKey.

In particular, this should fail:

var publicKey mldsa.PublicKey

if err := mldsa.Verify(&publicKey, []byte("message"), nil, nil); err == nil {
	t.Fatal("Verify accepted uninitialized public key and empty signature")
}

[dmitshur]

Thanks for trying out the package ahead of the release and reporting this finding. CC @golang/security.

Tentatively marking as a release blocker since this package is new to Go 1.27.

[thatnealpatel]

The referenced commit does not exist: 7132bcb

Additionally, this cannot run on go 1.26.1; it does run on gotip.

[gopherbot]

Change https://go.dev/cl/800860 mentions this issue: crypto/mldsa: handle some uninitialized and nil values more gracefully