{"record":{"id":"6947e8f293db8278","repo":"golang/go","slug":"crypto-rsa-public-exponent-too-large","errorCode":null,"errorMessage":"crypto/rsa: public exponent too large","messagePattern":"crypto/rsa: public exponent too large","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/rsa.go","lineNumber":361,"sourceCode":"\tif pub.E < 2 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent too small or negative\")\n\t}\n\t// e needs to be coprime with p-1 and q-1, since it must be invertible\n\t// modulo λ(pq). Since p and q are prime, this means e needs to be odd.\n\tif pub.E&1 == 0 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent is even\")\n\t}\n\t// FIPS 186-5, Section 5.5(e): \"The exponent e shall be an odd, positive\n\t// integer such that 2¹⁶ < e < 2²⁵⁶.\"\n\tif pub.E <= 1<<16 {\n\t\tfipsApproved = false\n\t}\n\t// We require pub.E to fit into a 32-bit integer so that we\n\t// do not have different behavior depending on whether\n\t// int is 32 or 64 bits. See also\n\t// https://www.imperialviolet.org/2012/03/16/rsae.html.\n\tif pub.E > 1<<31-1 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent too large\")\n\t}\n\treturn fipsApproved, nil\n}\n\n// Encrypt performs the RSA public key operation.\nfunc Encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\tif _, err := checkPublicKey(pub); err != nil {\n\t\treturn nil, err\n\t}\n\treturn encrypt(pub, plaintext)\n}\n\nfunc encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {\n\tm, err := bigmod.NewNat().SetBytes(plaintext, pub.N)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/rsa.go#L343-L379","documentation":"Returned by checkPublicKey when pub.E exceeds 2^31-1 (max int32). The Go implementation requires E to fit in a 32-bit int so behavior is identical whether the platform int is 32 or 64 bits (see the linked imperialviolet note on RSAE). FIPS 186-5 allows e < 2^256, but Go deliberately caps tighter than the standard for cross-platform determinism. This is a hard error, not a soft FIPS flag.","triggerScenarios":"Passing a PublicKey whose E field holds a value > 2147483647 into any RSA API that calls checkPublicKey. Common with keys parsed from arbitrary bignum ASN.1 where E was decoded as a large integer, or with deliberately adversarial/fuzzed key material.","commonSituations":"A DER parser bug that misreads the ASN.1 INTEGER for E and produces a multi-word value; adversarial test vectors from a fuzzer; importing a key that was never meant to be used as RSA (e.g. a DSA/EC parameter mislabeled).","solutions":["Use E = 65537 (0x10001) — well within int32 and universally supported.","If the key was loaded from disk/network, dump pub.E and verify it equals 65537 (or another small odd value); a huge E means the parser is wrong.","Fix the ASN.1/DER decoder so the E INTEGER is read as a single small integer rather than a full bignum.","Reject keys with E > 2^31-1 at the trust boundary before calling into the crypto package."],"exampleFix":"// before\npub := &rsa.PublicKey{N: n, E: 1 << 31} // too large -> error\n// after\npub := &rsa.PublicKey{N: n, E: 65537}","handlingStrategy":"validation","validationCode":"func exponentFitsInt32(e int) bool { return e >= 2 && e <= 1<<31-1 }\nif !exponentFitsInt32(pub.E) {\n    return errors.New(\"RSA exponent out of int32 range; key parsing likely broken\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use E = 65537 exclusively.","Sanity-check the decoded E value after ASN.1 parsing; it should fit in a uint32 with room to spare.","Reject keys whose E reads as a multi-word bignum — that is almost always a decoder bug."],"tags":["crypto","rsa","public-key","validation","go-stdlib"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}