{"record":{"id":"546ee9c09443cbbb","repo":"golang/go","slug":"crypto-rand-use-of-prime-is-not-allowed-in-fips-1","errorCode":null,"errorMessage":"crypto/rand: use of Prime is not allowed in FIPS 140-only mode","messagePattern":"crypto/rand: use of Prime is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rand/util.go","lineNumber":23,"sourceCode":"package rand\n\nimport (\n\t\"crypto/internal/fips140only\"\n\t\"crypto/internal/rand\"\n\t\"errors\"\n\t\"io\"\n\t\"math/big\"\n)\n\n// Prime returns a number of the given bit length that is prime with high probability.\n// Prime will return error for any error returned by rand.Read or if bits < 2.\n//\n// Since Go 1.26, a secure source of random bytes is always used, and the Reader is\n// ignored unless GODEBUG=cryptocustomrand=1 is set. This setting will be removed\n// in a future Go release. Instead, use [testing/cryptotest.SetGlobalRandom].\nfunc Prime(r io.Reader, bits int) (*big.Int, error) {\n\tif fips140only.Enforced() {\n\t\treturn nil, errors.New(\"crypto/rand: use of Prime is not allowed in FIPS 140-only mode\")\n\t}\n\tif bits < 2 {\n\t\treturn nil, errors.New(\"crypto/rand: prime size must be at least 2-bit\")\n\t}\n\n\tr = rand.CustomReader(r)\n\n\tb := uint(bits % 8)\n\tif b == 0 {\n\t\tb = 8\n\t}\n\n\tbytes := make([]byte, (bits+7)/8)\n\tp := new(big.Int)\n\n\tfor {\n\t\tif _, err := io.ReadFull(r, bytes); err != nil {\n\t\t\treturn nil, err","sourceCodeStart":5,"sourceCodeEnd":41,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rand/util.go#L5-L41","documentation":"Returned by crypto/rand.Prime when FIPS 140-only mode is enforced. Prime() is excluded from FIPS approval because it is used to build arbitrary-length primes for non-approved primitives (e.g., DSA, custom DH); the FIPS module therefore blocks it entirely. The guard is the first statement in Prime, before any bit-length validation.","triggerScenarios":"Calling rand.Prime(r, bits) in a binary built with FIPS 140-only enforcement. Importing crypto/rand.Prime indirectly through a higher-level primitive.","commonSituations":"Generating RSA/DH parameters with rand.Prime in a FIPS-only service. Legacy code using rand.Prime for probabilistic prime generation. Libraries (e.g., crypto/dsa) that internally rely on Prime.","solutions":["Use an approved primitive for prime-based key generation (e.g., rsa.GenerateKey) instead of rand.Prime directly.","Run the affected code path outside FIPS-only mode if prime generation is genuinely required.","Refactor to avoid ad-hoc prime generation; prefer library-level approved generators."],"exampleFix":"// before (FIPS-only build)\np, err := rand.Prime(rand.Reader, 256) // blocked\n\n// after\nkey, err := rsa.GenerateKey(rand.Reader, 2048) // approved path","handlingStrategy":"validation","validationCode":"if fips140only.Enforced() {\n    return nil, errors.New(\"rand.Prime not allowed in FIPS mode; use rsa.GenerateKey\")\n}\nreturn rand.Prime(r, bits)","typeGuard":"func primeAllowed() bool { return !fips140only.Enforced() }","tryCatchPattern":"p, err := rand.Prime(r, bits)\nif err != nil && strings.Contains(err.Error(), \"Prime is not allowed in FIPS 140-only mode\") {\n    // switch to an approved generator or run outside FIPS mode\n    return nil, err\n}\nreturn p, err","preventionTips":["Avoid direct rand.Prime; use approved key-generation primitives.","Detect FIPS-only mode at startup and disable affected features.","Audit the dependency tree for crypto/rand.Prime usage."],"tags":["cryptography","go","rand","fips140","prime","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}