{"record":{"id":"874258bf85d70246","repo":"golang/go","slug":"crypto-rsa-use-of-keys-with-odd-size-is-not-allow","errorCode":null,"errorMessage":"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/fips.go","lineNumber":447,"sourceCode":"\treturn err\n}\n\nfunc fipsError2[T any](x T, err error) (T, error) {\n\treturn x, fipsError(err)\n}\n\nfunc checkFIPS140OnlyPublicKey(pub *PublicKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif pub.N == nil {\n\t\treturn errors.New(\"crypto/rsa: public key missing N\")\n\t}\n\tif pub.N.BitLen() < 2048 {\n\t\treturn errors.New(\"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.N.BitLen()%2 == 1 {\n\t\treturn errors.New(\"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E <= 1<<16 {\n\t\treturn errors.New(\"crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E&1 == 0 {\n\t\treturn errors.New(\"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n\nfunc checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {\n\t\treturn err\n\t}\n\tif len(priv.Primes) != 2 {","sourceCodeStart":429,"sourceCodeEnd":465,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/fips.go#L429-L465","documentation":"Thrown by checkFIPS140OnlyPublicKey when fips140only.Enforced() and pub.N.BitLen() is odd. An RSA modulus is the product of two primes; FIPS requires the two primes to be of equal bit length, which yields an even modulus bit length. An odd bit length implies primes of unequal size (e.g. a 1025-bit modulus), which is non-compliant and a sign of a malformed or non-standard key.","triggerScenarios":"Loading a key whose N has an odd bit length — typically the result of a buggy/malicious key generator, a manually-constructed key, or a parser that produced an off-by-one modulus.","commonSituations":"Keys generated by non-Go libraries with unbalanced primes. Adversarially-crafted keys. Rare: a key with a leading zero byte stripped during encoding shifting the effective bit length.","solutions":["Regenerate the key with rsa.GenerateKey(rand.Reader, 2048) which always produces balanced primes and an even bit length.","Reject keys at load time: if pub.N.BitLen()%2 == 1 { return error }.","If parsing external keys, validate bit-length parity before use."],"exampleFix":"// before\n// externally-supplied key with odd bit length\nsig, err := rsa.SignPSS(rand.Reader, oddKey, crypto.SHA256, digest, opts)\n\n// after\npriv, _ := rsa.GenerateKey(rand.Reader, 2048) // guaranteed even bit length\nsig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)","handlingStrategy":"validation","validationCode":"if pub.N.BitLen()%2 == 1 {\n    return fmt.Errorf(\"RSA modulus has odd bit length %d; FIPS requires even (balanced primes)\", pub.N.BitLen())\n}\n// proceed","typeGuard":"func keyHasEvenBitLength(pub *rsa.PublicKey) bool {\n    return pub != nil && pub.N != nil && pub.N.BitLen()%2 == 0\n}","tryCatchPattern":null,"preventionTips":["Generate keys with rsa.GenerateKey which always produces balanced primes (even bit length).","Reject externally-supplied keys with odd bit length at load time.","Validate both primes' bit lengths when parsing private keys."],"tags":["crypto","rsa","fips","key-validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}