{"record":{"id":"9060530167e3f23b","repo":"golang/go","slug":"crypto-rsa-decryption-error","errorCode":null,"errorMessage":"crypto/rsa: decryption error","messagePattern":"crypto/rsa: decryption error","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/rsa.go","lineNumber":384,"sourceCode":"// Encrypt performs the RSA public key operation.\nfunc Encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\tif _, err := checkPublicKey(pub); err != nil {\n\t\treturn nil, err\n\t}\n\treturn encrypt(pub, plaintext)\n}\n\nfunc encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {\n\tm, err := bigmod.NewNat().SetBytes(plaintext, pub.N)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn bigmod.NewNat().ExpShortVarTime(m, uint(pub.E), pub.N).Bytes(pub.N), nil\n}\n\nvar ErrMessageTooLong = errors.New(\"crypto/rsa: message too long for RSA key size\")\nvar ErrDecryption = errors.New(\"crypto/rsa: decryption error\")\nvar ErrVerification = errors.New(\"crypto/rsa: verification error\")\n\nconst withCheck = true\nconst noCheck = false\n\n// DecryptWithoutCheck performs the RSA private key operation.\nfunc DecryptWithoutCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\treturn decrypt(priv, ciphertext, noCheck)\n}\n\n// DecryptWithCheck performs the RSA private key operation and checks the\n// result to defend against errors in the CRT computation.\nfunc DecryptWithCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\treturn decrypt(priv, ciphertext, withCheck)\n}\n","sourceCodeStart":366,"sourceCodeEnd":402,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/rsa.go#L366-L402","documentation":"ErrDecryption is the deliberately generic error returned whenever an RSA private-key operation fails: wrong key, malformed ciphertext, or a PKCS#1 v1.5 / OAEP padding check failure. The message is intentionally vague to avoid leaking which sub-check failed and prevent Bleichenbacher-style padding-oracle attacks.","triggerScenarios":"Calling Decrypt (PKCS1v15 or OAEP) with: a ciphertext not produced by the matching public key; a ciphertext truncated/corrupted in transit; the wrong PrivateKey; random bytes; or a ciphertext encrypted under a different hash/MGF label than the decrypt side expects.","commonSituations":"Ciphertext base64-decoded with the wrong alphabet or padding; key rotation where the client still encrypts to the old public key; network framing bug that drops trailing bytes; OAEP label mismatch between encrypt and decrypt ends.","solutions":["Verify you are using the PrivateKey that corresponds (modulus-equal) to the PublicKey that encrypted.","Confirm the exact same OAEP label, MGF hash, and primary hash are used on both sides.","Re-check the ciphertext byte length equals the modulus byte length; re-examine base64/hex decoding on the wire.","Treat the error as unauthenticated and do not branch user-visible behavior on it (do not distinguish 'wrong key' from 'corrupt')."],"exampleFix":"// before\npt, err := rsa.DecryptOAEP(sha256.New(), rand, priv, ct, []byte(\"wronglabel\"))\n// after\npt, err := rsa.DecryptOAEP(sha256.New(), rand, priv, ct, []byte(\"correctlabel\"))","handlingStrategy":"try-catch","validationCode":"if len(ciphertext) != (priv.N.BitLen()+7)/8 {\n    return errors.New(\"ciphertext length does not match key size\")\n}","typeGuard":null,"tryCatchPattern":"pt, err := rsa.DecryptOAEP(sha256.New(), rand, priv, ct, label)\nif errors.Is(err, rsa.ErrDecryption) {\n    // do NOT distinguish root cause; treat as auth failure\n    return errors.New(\"decryption failed\")\n}","preventionTips":["Verify the ciphertext length equals the modulus byte length before calling Decrypt.","Ensure encrypt and decrypt use the identical OAEP label, MGF hash, and primary hash.","Never branch user-visible behavior on ErrDecryption details — that is an oracle.","Log decryption failures with a constant message and rate-limit the log."],"tags":["crypto","rsa","decryption","security","go-stdlib"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}