{"record":{"id":"3ba78f73d26eef72","repo":"golang/go","slug":"crypto-rsa-public-exponent-is-even","errorCode":null,"errorMessage":"crypto/rsa: public exponent is even","messagePattern":"crypto/rsa: public exponent is even","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/rsa.go","lineNumber":349,"sourceCode":"\tif pub.N.Nat().IsOdd() == 0 {\n\t\treturn false, errors.New(\"crypto/rsa: public modulus is even\")\n\t}\n\t// FIPS 186-5, Section 5.1: \"This standard specifies the use of a modulus\n\t// whose bit length is an even integer and greater than or equal to 2048\n\t// bits.\"\n\tif pub.N.BitLen() < 2048 {\n\t\tfipsApproved = false\n\t}\n\tif pub.N.BitLen()%2 == 1 {\n\t\tfipsApproved = false\n\t}\n\tif pub.E < 2 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent too small or negative\")\n\t}\n\t// e needs to be coprime with p-1 and q-1, since it must be invertible\n\t// modulo λ(pq). Since p and q are prime, this means e needs to be odd.\n\tif pub.E&1 == 0 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent is even\")\n\t}\n\t// FIPS 186-5, Section 5.5(e): \"The exponent e shall be an odd, positive\n\t// integer such that 2¹⁶ < e < 2²⁵⁶.\"\n\tif pub.E <= 1<<16 {\n\t\tfipsApproved = false\n\t}\n\t// We require pub.E to fit into a 32-bit integer so that we\n\t// do not have different behavior depending on whether\n\t// int is 32 or 64 bits. See also\n\t// https://www.imperialviolet.org/2012/03/16/rsae.html.\n\tif pub.E > 1<<31-1 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent too large\")\n\t}\n\treturn fipsApproved, nil\n}\n\n// Encrypt performs the RSA public key operation.\nfunc Encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/rsa.go#L331-L367","documentation":"Returned by checkPublicKey when the RSA public exponent E is even. RSA correctness requires e to be invertible modulo lambda(pq); since p and q are prime (odd), p-1 and q-1 are even, so e must be odd to be coprime. An even exponent has no inverse mod lambda(pq) and breaks encryption/decryption. The check pub.E&1 == 0 is a hard failure (returns false, err), unlike the FIPS-approval flags.","triggerScenarios":"Constructing a rsa.PublicKey (or fips140/rsa.PublicKey) with an even E value (e.g. 2, 4, 6, 65536) and calling any API that runs checkPublicKey: Encrypt, encrypt, signature verification, key validation. Even one zero low bit triggers it.","commonSituations":"Hardcoded test fixtures with a non-standard exponent; key material imported from a malformed PEM/DER where E was decoded incorrectly; custom key generators that pick E=3 (odd, fine) but accidentally compute a wrong E; big-endian/little-endian swap of E turning 0x10001 into an even value.","solutions":["Set E to the de-facto standard 65537 (0x10001) on the PublicKey; this is odd and FIPS-approved.","If you loaded the key from PEM/DER, re-decode it and inspect pub.E in hex; a wrong endianness or truncated field is the usual cause of an even E.","If you must use a small exponent for research, use 3 or 17 (both odd) — but note small exponents are not FIPS-approved and are flagged separately.","Add a unit assertion that pub.E&1 == 1 before passing the key into the crypto API."],"exampleFix":"// before\npub := &rsa.PublicKey{N: n, E: 65536} // even -> error\n// after\npub := &rsa.PublicKey{N: n, E: 65537} // 0x10001, odd","handlingStrategy":"validation","validationCode":"func validPublicExponent(e int) bool {\n    return e >= 2 && e&1 == 1 && e <= 1<<31-1\n}\n// before RSA ops:\nif !validPublicExponent(pub.E) {\n    return fmt.Errorf(\"invalid RSA exponent E=%d\", pub.E)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always construct RSA keys with E = 65537 (0x10001).","After parsing a key from PEM/DER, assert pub.E is odd and small before using it.","Treat any even or huge E as a parser bug, not as valid key material."],"tags":["crypto","rsa","public-key","validation","go-stdlib"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}