{"record":{"id":"52a18b4c5babd963","repo":"golang/go","slug":"crypto-rsa-only-crypto-rand-reader-is-allowed-in","errorCode":null,"errorMessage":"crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: only crypto/rand\\.Reader is allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/fips.go","lineNumber":97,"sourceCode":"\t\treturn boring.SignRSAPSS(bkey, hash, digest, opts.saltLength())\n\t}\n\tif priv.N.BitLen() >= 1024 {\n\t\tboring.UnreachableExceptTests()\n\t}\n\n\tif !hash.Available() {\n\t\treturn nil, errors.New(\"crypto/rsa: requested hash function unavailable: \" + hash.String())\n\t}\n\th := fips140hash.Unwrap(hash.New())\n\n\tif err := checkFIPS140OnlyPrivateKey(priv); err != nil {\n\t\treturn nil, err\n\t}\n\tif fips140only.Enforced() && !fips140only.ApprovedHash(h) {\n\t\treturn nil, errors.New(\"crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t}\n\tif fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {\n\t\treturn nil, errors.New(\"crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode\")\n\t}\n\n\tk, err := fipsPrivateKey(priv)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tsaltLength := opts.saltLength()\n\tif fips140only.Enforced() && saltLength > h.Size() {\n\t\treturn nil, errors.New(\"crypto/rsa: use of PSS salt longer than the hash is not allowed in FIPS 140-only mode\")\n\t}\n\tswitch saltLength {\n\tcase PSSSaltLengthAuto:\n\t\tsaltLength, err = rsa.PSSMaxSaltLength(k.PublicKey(), h)\n\t\tif err != nil {\n\t\t\treturn nil, fipsError(err)\n\t\t}\n\tcase PSSSaltLengthEqualsHash:","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/fips.go#L79-L115","documentation":"Returned during RSA PSS signing in FIPS 140-only mode when the random reader passed in is not crypto/rand.Reader. FIPS-approved signing must draw randomness exclusively from the approved RNG; custom or alternative readers are rejected via fips140only.ApprovedRandomReader. This ensures the non-deterministic PSS salt comes from a validated entropy source.","triggerScenarios":"Passing a custom io.Reader (e.g., a deterministic test reader, a pooled buffer, hmac.Drbg) to rsa.SignPSS in a FIPS-only build. Forgetting to pass rand.Reader and passing nil or a mock.","commonSituations":"Test code that injects a deterministic reader for reproducible PSS signatures. Libraries that accept a reader parameter and forward caller-supplied readers. Performance code reusing a buffer-backed reader.","solutions":["Always pass crypto/rand.Reader to rsa.SignPSS in FIPS builds.","For deterministic test signatures, run tests outside FIPS-only mode or use a non-FIPS test binary.","Audit any reader parameter forwarding to ensure only rand.Reader reaches the signer."],"exampleFix":"// before (FIPS-only build)\nsig, err := rsa.SignSS(mockReader, priv, crypto.SHA256, digest, opts) // error\n\n// after\nsig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)","handlingStrategy":"validation","validationCode":"if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {\n    random = crypto/rand.Reader\n}\nreturn rsa.SignPSS(random, priv, hash, digest, opts)","typeGuard":"func isApprovedReader(r io.Reader) bool {\n    return fips140only.ApprovedRandomReader(r)\n}","tryCatchPattern":"sig, err := rsa.SignPSS(random, priv, hash, digest, opts)\nif err != nil && strings.Contains(err.Error(), \"only crypto/rand.Reader is allowed\") {\n    sig, err = rsa.SignPSS(crypto/rand.Reader, priv, hash, digest, opts)\n}\nreturn sig, err","preventionTips":["Always pass crypto/rand.Reader to RSA signing in FIPS builds.","Reserve deterministic readers for non-FIPS test binaries.","Audit any function that accepts an io.Reader and forwards it to signing."],"tags":["cryptography","go","rsa","pss","fips140","random-reader","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}