{"record":{"id":"45be56a326ff852a","repo":"golang/go","slug":"crypto-dsa-parameters-not-set-up-before-generatin","errorCode":null,"errorMessage":"crypto/dsa: parameters not set up before generating key","messagePattern":"crypto/dsa: parameters not set up before generating key","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/dsa/dsa.go","lineNumber":170,"sourceCode":"\t\tif g.Cmp(one) == 0 {\n\t\t\th.Add(h, one)\n\t\t\tcontinue\n\t\t}\n\n\t\tparams.G = g\n\t\treturn nil\n\t}\n}\n\n// GenerateKey generates a public&private key pair. The Parameters of the\n// [PrivateKey] must already be valid (see [GenerateParameters]).\nfunc GenerateKey(priv *PrivateKey, rand io.Reader) error {\n\tif fips140only.Enforced() {\n\t\treturn errors.New(\"crypto/dsa: use of DSA is not allowed in FIPS 140-only mode\")\n\t}\n\n\tif priv.P == nil || priv.Q == nil || priv.G == nil {\n\t\treturn errors.New(\"crypto/dsa: parameters not set up before generating key\")\n\t}\n\n\tx := new(big.Int)\n\txBytes := make([]byte, priv.Q.BitLen()/8)\n\n\tfor {\n\t\t_, err := io.ReadFull(rand, xBytes)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tx.SetBytes(xBytes)\n\t\tif x.Sign() != 0 && x.Cmp(priv.Q) < 0 {\n\t\t\tbreak\n\t\t}\n\t}\n\n\tpriv.X = x\n\tpriv.Y = new(big.Int)","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/dsa/dsa.go#L152-L188","documentation":"GenerateKey requires that the PrivateKey's Parameters (P, Q, G) already be set, normally by a prior successful call to GenerateParameters. If any of priv.P, priv.Q, or priv.G is nil, the function returns this error immediately (after the FIPS check), because it cannot compute a valid key without domain parameters.","triggerScenarios":"Calling dsa.GenerateKey on a freshly allocated *dsa.PrivateKey whose Parameters were never populated; skipping the GenerateParameters step; failed GenerateParameters (error ignored) followed by GenerateKey.","commonSituations":"Copy-paste missing the parameter-generation step; ignoring the error from GenerateParameters; reusing a zero-value PrivateKey struct.","solutions":["Call dsa.GenerateParameters(&priv.Parameters, rand.Reader, sizes) first and check its error.","Only call GenerateKey after parameters are confirmed valid.","If loading parameters from elsewhere, populate priv.P, priv.Q, priv.G explicitly before GenerateKey."],"exampleFix":"// before\nvar priv dsa.PrivateKey\ndsa.GenerateKey(&priv, rand.Reader) // P, Q, G are nil\n// after\nvar priv dsa.PrivateKey\ndsa.GenerateParameters(&priv.Parameters, rand.Reader, dsa.L2048N256)\ndsa.GenerateKey(&priv, rand.Reader)","handlingStrategy":"validation","validationCode":"func genDSAKey(rand io.Reader) (*dsa.PrivateKey, error) {\n    var priv dsa.PrivateKey\n    if err := dsa.GenerateParameters(&priv.Parameters, rand, dsa.L2048N256); err != nil {\n        return nil, err\n    }\n    if priv.P == nil || priv.Q == nil || priv.G == nil {\n        return nil, errors.New(\"DSA parameters not generated\")\n    }\n    if err := dsa.GenerateKey(&priv, rand); err != nil {\n        return nil, err\n    }\n    return &priv, nil\n}","typeGuard":"func dsaParamsSet(p *dsa.PrivateKey) bool {\n    return p != nil && p.P != nil && p.Q != nil && p.G != nil\n}","tryCatchPattern":null,"preventionTips":["Always run GenerateParameters before GenerateKey and check its error.","Never pass a zero-value *dsa.PrivateKey to GenerateKey.","Encapsulate the two-step sequence in one helper to prevent skipping."],"tags":["crypto","dsa","validation","go"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:31:55.035Z"}