{"record":{"id":"870d434502412be3","repo":"golang/go","slug":"crypto-hkdf-use-of-hash-functions-other-than-sha","errorCode":null,"errorMessage":"crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode","messagePattern":"crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/hkdf/hkdf.go","lineNumber":81,"sourceCode":"\t}\n\n\tlimit := fh().Size() * 255\n\tif keyLength > limit {\n\t\treturn nil, errors.New(\"hkdf: requested key length too large\")\n\t}\n\n\treturn hkdf.Key(fh, secret, salt, info, keyLength), nil\n}\n\nfunc checkFIPS140Only[Hash hash.Hash](h func() Hash, key []byte) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif len(key) < 112/8 {\n\t\treturn errors.New(\"crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif !fips140only.ApprovedHash(h()) {\n\t\treturn errors.New(\"crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":63,"sourceCodeEnd":85,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/hkdf/hkdf.go#L63-L85","documentation":"Thrown by checkFIPS140Only (hkdf.go:81) when FIPS 140-only mode is active and the hash function is not an approved SHA-2 or SHA-3 variant (fips140only.ApprovedHash returns false). HKDF built on MD5, SHA-1, BLAKE2, or non-approved hashes is not FIPS-validated.","triggerScenarios":"Calling hkdf.Expand/Key with h = md5.New, sha1.New, or crypto.BLAKE2b_512.New while fips140only.Enforced(). Approved hashes are SHA-224/256/384/512 and SHA3-224/256/384/512.","commonSituations":"Interop code selecting SHA-1/MD5 for a legacy peer; config pinning a non-approved hash; enabling FIPS mode without auditing the HKDF hash selection.","solutions":["Use an approved hash: sha256.New, sha512.New, or a SHA-3 constructor.","Disable FIPS 140-only mode if a non-approved hash is required for legacy interop and compliance is not needed.","Validate the hash is SHA-2/SHA-3 before calling HKDF under FIPS builds."],"exampleFix":"// before\nkey, err := hkdf.Key(sha1.New, secret, salt, \"k\", 32) // FIPS-only -> error 258\n\n// after\nkey, err := hkdf.Key(sha256.New, secret, salt, \"k\", 32)","handlingStrategy":"validation","validationCode":"if fips140only.Enforced() && !fips140only.ApprovedHash(h()) {\n    return errors.New(\"HKDF hash must be SHA-2 or SHA-3 in FIPS 140-only mode\")\n}","typeGuard":"func isApprovedHash(h crypto.Hash) bool {\n    switch h {\n    case crypto.SHA224, crypto.SHA256, crypto.SHA384, crypto.SHA512,\n        crypto.SHA3_224, crypto.SHA3_256, crypto.SHA3_384, crypto.SHA3_512:\n        return true\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Use SHA-256/384/512 or SHA-3 for HKDF under FIPS builds.","Disable FIPS mode only if a legacy hash is required.","Document the approved hash list for your callers."],"tags":["go","crypto","hkdf","fips","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}