{"record":{"id":"15940539cd47d284","repo":"golang/go","slug":"crypto-rsa-message-too-long-for-rsa-key-size-159405","errorCode":null,"errorMessage":"crypto/rsa: message too long for RSA key size","messagePattern":"crypto/rsa: message too long for RSA key size","errorType":"exception","errorClass":"ErrMessageTooLong","httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":541,"sourceCode":"\t\tif ok != nil {\n\t\t\tpriv.Primes = primes\n\t\t\tpriv.N = n\n\t\t\tbreak\n\t\t}\n\t}\n\n\tpriv.Precompute()\n\tif err := priv.Validate(); err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn priv, nil\n}\n\n// ErrMessageTooLong is returned when attempting to encrypt or sign a message\n// which is too large for the size of the key. When using [SignPSS], this can also\n// be returned if the size of the salt is too large.\nvar ErrMessageTooLong = errors.New(\"crypto/rsa: message too long for RSA key size\")\n\n// ErrDecryption represents a failure to decrypt a message.\n// It is deliberately vague to avoid adaptive attacks.\nvar ErrDecryption = errors.New(\"crypto/rsa: decryption error\")\n\n// ErrVerification represents a failure to verify a signature.\n// It is deliberately vague to avoid adaptive attacks.\nvar ErrVerification = errors.New(\"crypto/rsa: verification error\")\n\n// Precompute performs some calculations that speed up private key operations in\n// the future. It is safe to run on non-validated private keys, and it can speed\n// up future calls to [PrivateKey.Validate] for valid keys.\n//\n// Precompute writes to the Precomputed field, so it must not be called\n// concurrently with any other method.\n//\n// Precompute does not return an error. Applications should call\n// [PrivateKey.Validate] after Precompute to check for any problems with the","sourceCodeStart":523,"sourceCodeEnd":559,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L523-L559","documentation":"ErrMessageTooLong is a sentinel error (var, not a stringly-typed error) returned when an encrypt or sign input is too large for the key size and selected padding. Concretely: PKCS#1 v1.5 encrypt needs len(msg) <= k-11; OAEP needs len(msg) <= k - 2*hashLen - 2; PSS signing needs len(msg)+saltLen <= k-2 (oversized salt included). Callers should compare with errors.Is because the same var is reused across EncryptPKCS1v15/EncryptOAEP/SignPSS.","triggerScenarios":"rsa.EncryptPKCS1v15(rand.Reader, pub, bigMsg) with len(bigMsg) > pub.Size()-11; rsa.EncryptOAEP with a payload larger than k-2*hLen-2; rsa.SignPSS with a salt length that, combined with the message digest input, exceeds the modulus; using a 1024-bit key to encrypt a 256-byte message.","commonSituations":"Forgetting that RSA encrypts only small payloads (symmetric keys, digests) and trying to encrypt arbitrary data directly; switching from PKCS#1 v1.5 to OAEP without re-checking the size budget (OAEP has tighter overhead); PSS with SaltLength = rsa.PSSSaltLengthEqualsHash on a key whose modulus is too small.","solutions":["Use hybrid encryption: encrypt a random AES key with RSA, then AES-GCM the payload.","Switch to a larger RSA key (3072/4096) to gain payload budget.","For PSS, set opts.SaltLength explicitly (e.g. rsa.PSSSaltLength auto-fits) instead of a fixed large value.","Compare with errors.Is(err, rsa.ErrMessageTooLong) to differentiate from other RSA errors."],"exampleFix":"// before: encrypting a large payload directly\nct, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, pub, bigMsg, nil) // err: message too long\n\n// after: hybrid encryption\nkey := make([]byte, 32)\nrand.Read(key)\nwrapped, _ := rsa.EncryptOAEP(sha256.New(), rand.Reader, pub, key, nil)\nct := aesgcmSeal(key, bigMsg) // AES-GCM payload separately","handlingStrategy":"validation","validationCode":"func maxOAEPBytes(pub *rsa.PublicKey, h crypto.Hash) int {\n    return pub.Size() - 2*h.Size() - 2\n}\nif len(msg) > maxOAEPBytes(pub, crypto.SHA256) {\n    return errors.New(\"payload too large for RSA-OAEP; use hybrid encryption\")\n}","typeGuard":null,"tryCatchPattern":"if errors.Is(err, rsa.ErrMessageTooLong) {\n    // switch to hybrid: wrap a random AES key with RSA-OAEP, AES-GCM the payload\n}","preventionTips":["Never encrypt bulk data with RSA — use hybrid (RSA + AES-GCM).","Re-check the size budget when changing padding (PKCS1v15 → OAEP tightens it).","For PSS, set opts.SaltLength to rsa.PSSSaltLengthEqualsHash or auto."],"tags":["rsa","encryption","signing","padding","crypto"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}