{"record":{"id":"3e07be46517553cc","repo":"golang/go","slug":"crypto-rsa-use-of-keys-smaller-than-2048-bits-is","errorCode":null,"errorMessage":"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/fips.go","lineNumber":444,"sourceCode":"\tcase rsa.ErrMessageTooLong:\n\t\treturn ErrMessageTooLong\n\t}\n\treturn err\n}\n\nfunc fipsError2[T any](x T, err error) (T, error) {\n\treturn x, fipsError(err)\n}\n\nfunc checkFIPS140OnlyPublicKey(pub *PublicKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif pub.N == nil {\n\t\treturn errors.New(\"crypto/rsa: public key missing N\")\n\t}\n\tif pub.N.BitLen() < 2048 {\n\t\treturn errors.New(\"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.N.BitLen()%2 == 1 {\n\t\treturn errors.New(\"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E <= 1<<16 {\n\t\treturn errors.New(\"crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E&1 == 0 {\n\t\treturn errors.New(\"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n\nfunc checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/fips.go#L426-L462","documentation":"Thrown by checkFIPS140OnlyPublicKey when fips140only.Enforced() and pub.N.BitLen() < 2048. FIPS 140-3 / SP 800-56Br2 mandates RSA moduli of at least 2048 bits for key establishment and signing. 1024-bit keys (and smaller) that worked in non-FIPS builds are rejected.","triggerScenarios":"Using a 1024-bit RSA key (BitLen()==1024) in any SignPSS/VerifyPSS/SignPKCS1v15/VerifyPKCS1v15/EncryptOAEP/DecryptOAEP call under FIPS-only enforcement. Loading an old certificate's key that predates the 2048-bit baseline.","commonSituations":"Legacy infrastructure with 1024-bit root/intermediate keys. Embedded/device certs generated under old key-size norms. Cost-optimized key generation that picked 1024 bits historically.","solutions":["Generate a new 2048-bit (or larger, e.g. 3072) key: rsa.GenerateKey(rand.Reader, 2048).","Re-issue certificates and re-sign artifacts with the new key; rotate peers onto it.","If a 1024-bit key is unavoidable, that operation must run outside FIPS-only mode."],"exampleFix":"// before\npriv, _ := rsa.GenerateKey(rand.Reader, 1024)\nsig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)\n\n// after\npriv, _ := rsa.GenerateKey(rand.Reader, 2048)\nsig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)","handlingStrategy":"validation","validationCode":"if pub.N.BitLen() < 2048 {\n    return fmt.Errorf(\"RSA key is %d bits; FIPS requires >= 2048\", pub.N.BitLen())\n}\n// proceed","typeGuard":"func keyMeetsFIPSSize(pub *rsa.PublicKey) bool {\n    return pub != nil && pub.N != nil && pub.N.BitLen() >= 2048\n}","tryCatchPattern":null,"preventionTips":["Generate all new RSA keys at 2048 bits minimum (3072 recommended for long-term).","Audit existing keys/certs for < 2048-bit moduli before switching to FIPS-only.","Reject sub-2048 keys at the key-loading layer."],"tags":["crypto","rsa","fips","key-size"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}