{"record":{"id":"0e40d70073fd0048","repo":"golang/go","slug":"crypto-rsa-decryption-error-0e40d7","errorCode":null,"errorMessage":"crypto/rsa: decryption error","messagePattern":"crypto/rsa: decryption error","errorType":"exception","errorClass":"ErrDecryption","httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":545,"sourceCode":"\t\t}\n\t}\n\n\tpriv.Precompute()\n\tif err := priv.Validate(); err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn priv, nil\n}\n\n// ErrMessageTooLong is returned when attempting to encrypt or sign a message\n// which is too large for the size of the key. When using [SignPSS], this can also\n// be returned if the size of the salt is too large.\nvar ErrMessageTooLong = errors.New(\"crypto/rsa: message too long for RSA key size\")\n\n// ErrDecryption represents a failure to decrypt a message.\n// It is deliberately vague to avoid adaptive attacks.\nvar ErrDecryption = errors.New(\"crypto/rsa: decryption error\")\n\n// ErrVerification represents a failure to verify a signature.\n// It is deliberately vague to avoid adaptive attacks.\nvar ErrVerification = errors.New(\"crypto/rsa: verification error\")\n\n// Precompute performs some calculations that speed up private key operations in\n// the future. It is safe to run on non-validated private keys, and it can speed\n// up future calls to [PrivateKey.Validate] for valid keys.\n//\n// Precompute writes to the Precomputed field, so it must not be called\n// concurrently with any other method.\n//\n// Precompute does not return an error. Applications should call\n// [PrivateKey.Validate] after Precompute to check for any problems with the\n// key, including any that would cause Precompute to fail.\n//\n// Calling Precompute on a key that has already been precomputed is a no-op.\nfunc (priv *PrivateKey) Precompute() {","sourceCodeStart":527,"sourceCodeEnd":563,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L527-L563","documentation":"ErrDecryption is a sentinel error (var) returned by OAEP and PKCS#1 v1.5 decryption when the ciphertext cannot be unwrapped — wrong key, corrupted ciphertext, invalid padding, or a session-key-length mismatch. The comment is explicit: 'It is deliberately vague to avoid adaptive attacks.' Callers must NOT branch on the specific cause; treat every ErrDecryption identically to avoid leaking padding-validity via timing.","triggerScenarios":"rsa.DecryptOAEP with the wrong private key; DecryptPKCS1v15 on truncated ciphertext; DecryptPKCS1v15SessionKey where the padding bytes do not decode; ciphertext tampered in transit (authenticity failure).","commonSituations":"Wrong key selected from a keyring (kid mismatch); storage bit-rot; cross-system handoff where the peer encrypted with one pub key but you decrypt with another; replaying old ciphertext against a rotated key.","solutions":["Verify the key identity (kid) before decrypting; map ciphertext to the right private key.","Handle ErrDecryption uniformly: errors.Is(err, rsa.ErrDecryption) — do not log specifics or distinguish causes in user-visible behavior.","Re-encrypt/rotate the data with the current key if a key rotation mismatch is found.","For session-key decryption (DecryptPKCS1v15SessionKey), note that the output buffer is randomized on failure to keep timing constant — do not assume the plaintext is valid just because no error propagated in some wrappers."],"exampleFix":"// before\npt, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, priv, ct, nil)\nif err != nil {\n    log.Printf(\"decryption failed: %v\", err) // leaks specifics\n}\n\n// after\npt, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, priv, ct, nil)\nif err != nil {\n    // do not log or branch on the cause\n    return errors.New(\"invalid ciphertext\")\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"pt, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, priv, ct, nil)\nif errors.Is(err, rsa.ErrDecryption) {\n    // uniform handling: no logging of the cause, no differentiated response\n    return errors.New(\"invalid ciphertext\")\n}","preventionTips":["Verify the kid mapping before decrypting.","Never log specifics of ErrDecryption — branch uniformly to avoid side channels.","Rotate ciphertext when keys rotate; detect mismatches at the keyring layer."],"tags":["rsa","decryption","oaep","pkcs1v15","sentinel","crypto","side-channel"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}