{"record":{"id":"5b74125874297b9f","repo":"golang/go","slug":"crypto-rsa-only-crypto-rand-reader-is-allowed-in-5b7412","errorCode":null,"errorMessage":"crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: only crypto/rand\\.Reader is allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":368,"sourceCode":"\t\t\t\tDp:        Dp,\n\t\t\t\tDq:        Dq,\n\t\t\t\tQinv:      Qinv,\n\t\t\t\tCRTValues: make([]CRTValue, 0), // non-nil, to match Precompute\n\t\t\t},\n\t\t}\n\t\treturn key, nil\n\t}\n\n\trandom = rand.CustomReader(random)\n\n\tif fips140only.Enforced() && bits < 2048 {\n\t\treturn nil, errors.New(\"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif fips140only.Enforced() && bits%2 == 1 {\n\t\treturn nil, errors.New(\"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode\")\n\t}\n\tif fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {\n\t\treturn nil, errors.New(\"crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode\")\n\t}\n\n\tk, err := rsa.GenerateKey(random, bits)\n\tif bits < 256 && err != nil {\n\t\t// Toy-sized keys have a non-negligible chance of hitting two hard\n\t\t// failure cases: p == q and d <= 2^(nlen / 2).\n\t\t//\n\t\t// Since these are impossible to hit for real keys, we don't want to\n\t\t// make the production code path more complex and harder to think about\n\t\t// to handle them.\n\t\t//\n\t\t// Instead, just rerun the whole process a total of 8 times, which\n\t\t// brings the chance of failure for 32-bit keys down to the same as for\n\t\t// 256-bit keys.\n\t\tfor i := 1; i < 8 && err != nil; i++ {\n\t\t\tk, err = rsa.GenerateKey(random, bits)\n\t\t}\n\t}","sourceCodeStart":350,"sourceCodeEnd":386,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L350-L386","documentation":"Returned by GenerateKey when FIPS 140-only mode is active and the random reader passed in is not the approved default (crypto/rand.Reader). The check uses fips140only.ApprovedRandomReader, which is satisfied only by the standard reader (or nil in callers that default to it). FIPS 140-3 requires an SP 800-90A-compliant DRBG, so a user-supplied reader is disallowed in FIPS-only mode. Note the call first does rand.CustomReader(random), so wrapping the default reader in a custom type may also fail this check.","triggerScenarios":"Call rsa.GenerateKey(myReader, 2048) where myReader is a deterministic or test reader, under GODEBUG=fips140=only; pass a custom reader to introduce entropy from a different source; tests that inject a seeded reader without disabling FIPS-only.","commonSituations":"Reproducible-crypto tests under FIPS-only CI; integrating an HSM/RNG whose output is funneled through an io.Reader; legacy code that wrapped rand.Reader for logging.","solutions":["Pass rand.Reader (or nil-equivalent) directly so ApprovedRandomReader returns true.","For tests, use testing/cryptotest.SetGlobalRandom instead of substituting the reader argument, or set GODEBUG=cryptocustomrand=1 only in the test binary (and drop FIPS-only for those tests).","If you need a non-default entropy source for production, escalate — FIPS-only mode forbids it by design."],"exampleFix":"// before (under GODEBUG=fips140=only)\npriv, err := rsa.GenerateKey(myCustomReader, 2048) // err: only crypto/rand.Reader is allowed\n\n// after\npriv, err := rsa.GenerateKey(rand.Reader, 2048)","handlingStrategy":"validation","validationCode":"if !fips140only.ApprovedRandomReader(random) {\n    // outside the fips140only package, fall back to crypto/rand.Reader\n    random = rand.Reader\n}\nreturn rsa.GenerateKey(random, bits)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pass rand.Reader directly to GenerateKey; do not wrap it.","For tests, use testing/cryptotest.SetGlobalRandom or scope GODEBUG=cryptocustomrand=1 to the test binary only.","Audit third-party RNG wrappers that may be threaded into GenerateKey."],"tags":["fips","rsa","key-generation","random","fips140-only","crypto"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}