{"record":{"id":"8066b1d9f715982f","repo":"golang/go","slug":"crypto-rand-prime-size-must-be-at-least-2-bit","errorCode":null,"errorMessage":"crypto/rand: prime size must be at least 2-bit","messagePattern":"crypto/rand: prime size must be at least 2-bit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rand/util.go","lineNumber":26,"sourceCode":"\t\"crypto/internal/fips140only\"\n\t\"crypto/internal/rand\"\n\t\"errors\"\n\t\"io\"\n\t\"math/big\"\n)\n\n// Prime returns a number of the given bit length that is prime with high probability.\n// Prime will return error for any error returned by rand.Read or if bits < 2.\n//\n// Since Go 1.26, a secure source of random bytes is always used, and the Reader is\n// ignored unless GODEBUG=cryptocustomrand=1 is set. This setting will be removed\n// in a future Go release. Instead, use [testing/cryptotest.SetGlobalRandom].\nfunc Prime(r io.Reader, bits int) (*big.Int, error) {\n\tif fips140only.Enforced() {\n\t\treturn nil, errors.New(\"crypto/rand: use of Prime is not allowed in FIPS 140-only mode\")\n\t}\n\tif bits < 2 {\n\t\treturn nil, errors.New(\"crypto/rand: prime size must be at least 2-bit\")\n\t}\n\n\tr = rand.CustomReader(r)\n\n\tb := uint(bits % 8)\n\tif b == 0 {\n\t\tb = 8\n\t}\n\n\tbytes := make([]byte, (bits+7)/8)\n\tp := new(big.Int)\n\n\tfor {\n\t\tif _, err := io.ReadFull(r, bytes); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\t// Clear bits in the first byte to make sure the candidate has a size <= bits.","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rand/util.go#L8-L44","documentation":"Returned by crypto/rand.Prime when bits < 2. A prime of fewer than 2 bits is mathematically meaningless (the smallest prime is 2, a 2-bit number), so the function rejects it with an explicit error. This check runs after the FIPS guard, so it applies in both FIPS and non-FIPS builds.","triggerScenarios":"Calling rand.Prime(r, 0), rand.Prime(r, 1), or any negative value. Computing bits from an expression that can underflow to 0/1.","commonSituations":"Parameterizing bit length from untrusted config input. Off-by-one in bit-length arithmetic. Test loops that include degenerate bit sizes.","solutions":["Validate bits >= 2 before calling: if bits < 2 { return errors.New(\"...\") }.","Use standard prime sizes (e.g., 256 for DH q, 1024+ for safe primes).","Clamp configurable input to a safe minimum."],"exampleFix":"// before\np, err := rand.Prime(rand.Reader, 1) // error\n\n// after\nif bits < 2 { return fmt.Errorf(\"bits must be >= 2\") }\np, err := rand.Prime(rand.Reader, bits)","handlingStrategy":"validation","validationCode":"if bits < 2 {\n    return nil, fmt.Errorf(\"bits must be >= 2, got %d\", bits)\n}\nreturn rand.Prime(r, bits)","typeGuard":"func isValidBitLen(b int) bool { return b >= 2 }","tryCatchPattern":"p, err := rand.Prime(r, bits)\nif err != nil && strings.Contains(err.Error(), \"at least 2-bit\") {\n    return rand.Prime(r, 2)\n}\nreturn p, err","preventionTips":["Clamp configurable bit lengths to a safe minimum before calling Prime.","Validate external inputs feeding the bits parameter.","Test boundary values (2, 3, 8) explicitly."],"tags":["cryptography","go","rand","prime","input-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}