{"record":{"id":"8ce3a40ebbba8edd","repo":"golang/go","slug":"crypto-rsa-use-of-public-exponent-2-is-not-a","errorCode":null,"errorMessage":"crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/fips.go","lineNumber":450,"sourceCode":"func fipsError2[T any](x T, err error) (T, error) {\n\treturn x, fipsError(err)\n}\n\nfunc checkFIPS140OnlyPublicKey(pub *PublicKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif pub.N == nil {\n\t\treturn errors.New(\"crypto/rsa: public key missing N\")\n\t}\n\tif pub.N.BitLen() < 2048 {\n\t\treturn errors.New(\"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.N.BitLen()%2 == 1 {\n\t\treturn errors.New(\"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E <= 1<<16 {\n\t\treturn errors.New(\"crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E&1 == 0 {\n\t\treturn errors.New(\"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n\nfunc checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {\n\t\treturn err\n\t}\n\tif len(priv.Primes) != 2 {\n\t\treturn errors.New(\"crypto/rsa: use of multi-prime keys is not allowed in FIPS 140-only mode\")\n\t}\n\tif priv.Primes[0] == nil || priv.Primes[1] == nil || priv.Primes[0].BitLen() != priv.Primes[1].BitLen() {","sourceCodeStart":432,"sourceCodeEnd":468,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/fips.go#L432-L468","documentation":"Thrown by checkFIPS140OnlyPublicKey when fips140only.Enforced() and pub.E <= 1<<16 (65536). FIPS requires the public exponent to be strictly greater than 2^16 and odd. The standard exponent 65537 (0x10001) passes since 65537 > 65536; small exponents like 3, 17, 257, and 65537-1=65536 all fail. This rejects weak/small exponents mandated out by FIPS 186-4 section 5.1 and B.3.1.","triggerScenarios":"Using a key generated with exponent 3 or 17 (historically used for performance). A key with E == 65536 (even AND <= 2^16, also trips 498). Constructing a key literal with pub.E set too low.","commonSituations":"Legacy keys generated decades ago with E=3 for speed. Custom key-generation code that set E to a small prime. Keys from constrained environments that minimized exponent size.","solutions":["Regenerate the key with the default exponent 65537: rsa.GenerateKey uses 65537 automatically.","Validate at load time: if pub.E <= 1<<16 { reject }.","Rotate all peers/certs off small-exponent keys."],"exampleFix":"// before\n// key with E = 3\nsig, err := rsa.SignPSS(rand.Reader, weakExpKey, crypto.SHA256, digest, opts)\n\n// after\npriv, _ := rsa.GenerateKey(rand.Reader, 2048) // E defaults to 65537\nsig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)","handlingStrategy":"validation","validationCode":"if pub.E <= 1<<16 {\n    return fmt.Errorf(\"public exponent E=%d must be > 2^16 (65536) in FIPS-only mode; use 65537\", pub.E)\n}\n// proceed","typeGuard":"func exponentIsFIPSCompliant(e int) bool {\n    return e > 1<<16 && e&1 == 1\n}","tryCatchPattern":null,"preventionTips":["Always use 65537 as the public exponent — rsa.GenerateKey defaults to it.","Reject keys with small exponents (3, 17, 257) at load time.","Never construct rsa.PublicKey literals with a hand-picked E."],"tags":["crypto","rsa","fips","key-validation","exponent"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}