{"record":{"id":"1ab044b8b10f455e","repo":"golang/go","slug":"crypto-rsa-hashed-message-length-does-not-match-h","errorCode":null,"errorMessage":"crypto/rsa: hashed message length does not match hash function","messagePattern":"crypto/rsa: hashed message length does not match hash function","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/pkcs1v15.go","lineNumber":76,"sourceCode":"\tem, err := pkcs1v15ConstructEM(&priv.pub, hash, hashed)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn decrypt(priv, em, withCheck)\n}\n\nfunc pkcs1v15ConstructEM(pub *PublicKey, hash string, hashed []byte) ([]byte, error) {\n\t// Special case: \"\" is used to indicate that the data is signed directly.\n\tvar prefix []byte\n\tif hash != \"\" {\n\t\tvar ok bool\n\t\tprefix, ok = hashPrefixes[hash]\n\t\tif !ok {\n\t\t\treturn nil, errors.New(\"crypto/rsa: unsupported hash function\")\n\t\t}\n\t\tif len(hashed) != hashSize(hash) {\n\t\t\treturn nil, errors.New(\"crypto/rsa: hashed message length does not match hash function\")\n\t\t}\n\t}\n\n\t// EM = 0x00 || 0x01 || PS || 0x00 || T\n\tk := pub.Size()\n\tif k < len(prefix)+len(hashed)+2+8+1 {\n\t\treturn nil, ErrMessageTooLong\n\t}\n\tem := make([]byte, k)\n\tem[1] = 1\n\tfor i := 2; i < k-len(prefix)-len(hashed)-1; i++ {\n\t\tem[i] = 0xff\n\t}\n\tcopy(em[k-len(prefix)-len(hashed):], prefix)\n\tcopy(em[k-len(hashed):], hashed)\n\treturn em, nil\n}\n","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/pkcs1v15.go#L58-L94","documentation":"After resolving the hash function name in PKCS#1 v1.5 signing/verification, the library checks that len(hashed) matches the expected digest size for that hash (e.g., 32 bytes for SHA-256, 64 for SHA-512). A mismatch means the caller did not actually hash the message with the claimed algorithm, and signing it would produce a structurally invalid signature.","triggerScenarios":"Calling SignPKCS1v15 or VerifyPKCS1v15 where the hash parameter names SHA-256 but hashed is not 32 bytes, or names SHA-512 but hashed is not 64 bytes, etc.","commonSituations":"Hashing with a different algorithm than declared (e.g., SHA-384 but passing it as SHA-256); passing a truncated or padded digest; double-hashing or passing the raw message instead of its digest; using a wrong hash.Hash instance to produce the digest.","solutions":["Ensure the hash parameter matches the algorithm used to produce the digest","Let the library hash for you by using SignPKCS1v15 with a hash.Hash instance writing the message, if the API supports it","Verify len(hashed) == hashSize(hashName) before calling the function"],"exampleFix":"// before\nh := sha512.Sum512(msg)\nsig, err := rsa.SignPKCS1v15(rand, key, crypto.SHA256, h[:]) // wrong hash declared\n\n// after\nh := sha256.Sum256(msg)\nsig, err := rsa.SignPKCS1v15(rand, key, crypto.SHA256, h[:])","handlingStrategy":"validation","validationCode":"func validateDigestLength(hash crypto.Hash, digest []byte) error {\n    expected := 0\n    switch hash {\n    case crypto.SHA224: expected = 28\n    case crypto.SHA256: expected = 32\n    case crypto.SHA384: expected = 48\n    case crypto.SHA512: expected = 64\n    default: return fmt.Errorf(\"unsupported hash %v\", hash)\n    }\n    if len(digest) != expected {\n        return fmt.Errorf(\"digest length %d does not match %v (%d)\", len(digest), hash, expected)\n    }\n    return nil\n}\n\nif err := validateDigestLength(hashAlg, digest); err != nil { return err }\nsig, err := rsa.SignPKCS1v15(rand, key, hashAlg, digest)","typeGuard":null,"tryCatchPattern":"sig, err := rsa.SignPKCS1v15(rand, key, hashAlg, hashed)\nif err != nil {\n    return fmt.Errorf(\"PKCS#1 v1.5 signing failed (check hash/digest match): %w\", err)\n}","preventionTips":["Use the same hash.Hash instance to both declare the algorithm and compute the digest","Verify len(hashed) == hash.Size() before signing","Avoid copying digest bytes between different hash contexts"],"tags":["crypto","fips140","rsa","pkcs1v15","hash-mismatch","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}