{"record":{"id":"3c3b20976e909a0c","repo":"golang/go","slug":"crypto-hkdf-use-of-keys-shorter-than-112-bits-is","errorCode":null,"errorMessage":"crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode","messagePattern":"crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/hkdf/hkdf.go","lineNumber":78,"sourceCode":"\tfh := fips140hash.UnwrapNew(h)\n\tif err := checkFIPS140Only(fh, secret); err != nil {\n\t\treturn nil, err\n\t}\n\n\tlimit := fh().Size() * 255\n\tif keyLength > limit {\n\t\treturn nil, errors.New(\"hkdf: requested key length too large\")\n\t}\n\n\treturn hkdf.Key(fh, secret, salt, info, keyLength), nil\n}\n\nfunc checkFIPS140Only[Hash hash.Hash](h func() Hash, key []byte) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif len(key) < 112/8 {\n\t\treturn errors.New(\"crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif !fips140only.ApprovedHash(h()) {\n\t\treturn errors.New(\"crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":60,"sourceCodeEnd":85,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/hkdf/hkdf.go#L60-L85","documentation":"Thrown by checkFIPS140Only (hkdf.go:78) when FIPS 140-only mode is active and the input key (PRK or secret) is shorter than 112 bits (14 bytes). FIPS 140 SP 800-131A mandates a minimum 112-bit security strength; keys below that threshold are not approved.","triggerScenarios":"Calling hkdf.Expand/Key with a pseudorandomKey/secret shorter than 14 bytes while fips140only.Enforced(). Common with low-entropy shared secrets, short PINs, or test vectors.","commonSituations":"FIPS-validated build using a short password/secret as HKDF input; hard-coded test keys; deriving from a 64/128-bit value without prior extraction.","solutions":["Provide a key/secret of at least 14 bytes (112 bits); run a weak secret through HKDF-Extract or a KDF (Argon2/scrypt) first to reach the strength floor.","Disable FIPS 140-only mode if a short input is unavoidable and compliance is not required.","Audit HKDF inputs at the trust boundary to enforce len(key) >= 14 under FIPS builds."],"exampleFix":"// before\nprk := []byte(\"short\") // 5 bytes < 14\nkey, err := hkdf.Expand(sha256.New, prk, \"\", 32) // FIPS-only -> error 257\n\n// after\nprk := make([]byte, 32) // >= 14 bytes; sourced from a strong KDF\nkey, err := hkdf.Expand(sha256.New, prk, \"\", 32)","handlingStrategy":"validation","validationCode":"if fips140only.Enforced() && len(key) < 14 {\n    return errors.New(\"HKDF input key must be >= 112 bits in FIPS 140-only mode\")\n}","typeGuard":"func hkdfKeyMeetsFIPS(key []byte) bool {\n    return !fips140only.Enforced() || len(key) >= 14\n}","tryCatchPattern":null,"preventionTips":["Feed HKDF a PRK/secret of at least 14 bytes (112 bits).","Run weak secrets through HKDF-Extract or Argon2/scrypt first.","Disable FIPS mode only if a short input is unavoidable."],"tags":["go","crypto","hkdf","fips","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}