{"record":{"id":"4647d9eed24513a6","repo":"golang/go","slug":"crypto-rsa-generated-key-exponent-too-large","errorCode":null,"errorMessage":"crypto/rsa: generated key exponent too large","messagePattern":"crypto/rsa: generated key exponent too large","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":339,"sourceCode":"\t}\n\n\tif boring.Enabled && rand.IsDefaultReader(random) &&\n\t\t(bits == 2048 || bits == 3072 || bits == 4096) {\n\t\tbN, bE, bD, bP, bQ, bDp, bDq, bQinv, err := boring.GenerateKeyRSA(bits)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tN := bbig.Dec(bN)\n\t\tE := bbig.Dec(bE)\n\t\tD := bbig.Dec(bD)\n\t\tP := bbig.Dec(bP)\n\t\tQ := bbig.Dec(bQ)\n\t\tDp := bbig.Dec(bDp)\n\t\tDq := bbig.Dec(bDq)\n\t\tQinv := bbig.Dec(bQinv)\n\t\te64 := E.Int64()\n\t\tif !E.IsInt64() || int64(int(e64)) != e64 {\n\t\t\treturn nil, errors.New(\"crypto/rsa: generated key exponent too large\")\n\t\t}\n\n\t\tkey := &PrivateKey{\n\t\t\tPublicKey: PublicKey{\n\t\t\t\tN: N,\n\t\t\t\tE: int(e64),\n\t\t\t},\n\t\t\tD:      D,\n\t\t\tPrimes: []*big.Int{P, Q},\n\t\t\tPrecomputed: PrecomputedValues{\n\t\t\t\tDp:        Dp,\n\t\t\t\tDq:        Dq,\n\t\t\t\tQinv:      Qinv,\n\t\t\t\tCRTValues: make([]CRTValue, 0), // non-nil, to match Precompute\n\t\t\t},\n\t\t}\n\t\treturn key, nil\n\t}","sourceCodeStart":321,"sourceCodeEnd":357,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L321-L357","documentation":"Returned in the BoringCrypto branch of GenerateKey when the exponent E returned by boring.GenerateKeyRSA does not fit into an int (or its int64 cast loses bits). The BoringCrypto path is only taken when GOEXPERIMENT=boringcrypto is enabled and bits is 2048/3072/4096 with the default rand reader; in practice BoringCrypto returns E=65537, so this error indicates a BoringCrypto build/ABI mismatch or a corrupted BoringCrypto helper. It is not reachable on a normal (non-Boring) Go build.","triggerScenarios":"Build with GOEXPERIMENT=boringcrypto (or distro BoringCrypto build) and call rsa.GenerateKey(rand.Reader, 2048) where the underlying BoringCrypto returns a malformed exponent; mixing an incompatible BoringCrypto shared object into the toolchain.","commonSituations":"Custom distro Go toolchain with a patched BoringCrypto; building with -tags=fips140 vs GOEXPERIMENT=boringcrypto inconsistently; rare and almost always indicates a toolchain issue rather than user code.","solutions":["Retry rsa.GenerateKey once or twice — if transient, a new draw resolves it.","Rebuild with a stock Go toolchain (drop GOEXPERIMENT=boringcrypto) to bypass the BoringCrypto path; rsa.GenerateKey then uses the pure-Go generator.","If it reproduces, file a Go issue with your Go version, GOOS/GOARCH, and whether the toolchain is distro-provided."],"exampleFix":"// no user-side code fix; this is a toolchain/BoringCrypto integrity issue.\n// Workaround: build without boringcrypto.\n//   go build -tags='' ...\n// instead of GOEXPERIMENT=boringcrypto go build ...","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin a known-good Go toolchain version for BoringCrypto builds.","If reproducing, switch to the pure-Go generator by building without GOEXPERIMENT=boringcrypto.","Report reproducible occurrences to the Go project with toolchain details."],"tags":["rsa","boringcrypto","key-generation","toolchain","crypto"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}