{"record":{"id":"50dcfb03654ee9cc","repo":"golang/go","slug":"zero-parameter","errorCode":null,"errorMessage":"zero parameter","messagePattern":"zero parameter","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/crypto/ecdsa/ecdsa_legacy.go","lineNumber":57,"sourceCode":"// hashToInt converts a hash value to an integer. Per FIPS 186-4, Section 6.4,\n// we use the left-most bits of the hash to match the bit-length of the order of\n// the curve. This also performs Step 5 of SEC 1, Version 2.0, Section 4.1.3.\nfunc hashToInt(hash []byte, c elliptic.Curve) *big.Int {\n\torderBits := c.Params().N.BitLen()\n\torderBytes := (orderBits + 7) / 8\n\tif len(hash) > orderBytes {\n\t\thash = hash[:orderBytes]\n\t}\n\n\tret := new(big.Int).SetBytes(hash)\n\texcess := len(hash)*8 - orderBits\n\tif excess > 0 {\n\t\tret.Rsh(ret, uint(excess))\n\t}\n\treturn ret\n}\n\nvar errZeroParam = errors.New(\"zero parameter\")\n\n// Sign signs a hash (which should be the result of hashing a larger message)\n// using the private key, priv. If the hash is longer than the bit-length of the\n// private key's curve order, the hash will be truncated to that length. It\n// returns the signature as a pair of integers. Most applications should use\n// [SignASN1] instead of dealing directly with r, s.\n//\n// The signature is randomized. Since Go 1.26, a secure source of random bytes\n// is always used, and the Reader is ignored unless GODEBUG=cryptocustomrand=1\n// is set. This setting will be removed in a future Go release. Instead, use\n// [testing/cryptotest.SetGlobalRandom].\nfunc Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err error) {\n\tsig, err := SignASN1(rand, priv, hash)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tr, s = new(big.Int), new(big.Int)","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/ecdsa/ecdsa_legacy.go#L39-L75","documentation":"errZeroParam ('zero parameter') is thrown in signLegacy (ecdsa_legacy.go:110-111) when the curve order N.Sign() == 0, i.e. the curve's Params().N is zero. A curve with a zero order is degenerate/invalid; signing math (modular inverse, reduction mod N) would divide by zero. This is a guard against malformed custom curves.","triggerScenarios":"Calling ecdsa.Sign / SignASN1 on a PrivateKey whose Curve.Params().N == big.Int(0). Reached only via the legacy (non-FIPS) signing path for custom curves. Happens with a hand-rolled elliptic.Curve implementation that returns a zero N, or a corrupted curve parameter.","commonSituations":"Implementing a custom elliptic.Curve and forgetting to populate N; loading a curve from a misconfigured registry; porting curve params where N was dropped.","solutions":["Use a well-known curve (elliptic.P256 etc.) instead of a custom one; verify Params().N is a positive prime before signing.","If a custom curve is required, populate Params().N correctly (the curve order) and validate it is non-zero.","Validate priv.Curve.Params().N.Sign() > 0 before invoking Sign."],"exampleFix":"// before\nparams := &elliptic.CurveParams{Name: \"bad\", N: big.NewInt(0)} // N zero\npriv := &ecdsa.PrivateKey{PublicKey: ecdsa.PublicKey{Curve: params}}\n_, err := ecdsa.Sign(rand.Reader, priv, hash) // -> error 245\n\n// after\npriv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) // N correctly set","handlingStrategy":"validation","validationCode":"if priv.Curve == nil || priv.Curve.Params().N == nil || priv.Curve.Params().N.Sign() == 0 {\n    return errors.New(\"curve order N must be a positive prime\")\n}","typeGuard":"func curveOrderValid(c elliptic.Curve) bool {\n    return c != nil && c.Params().N != nil && c.Params().N.Sign() > 0\n}","tryCatchPattern":null,"preventionTips":["Avoid custom elliptic.Curve implementations; use the standard NIST curves.","When implementing a curve, populate Params().N with the correct curve order.","Validate N is a positive prime before any signing operation."],"tags":["go","crypto","ecdsa","validation","legacy"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}