{"record":{"id":"9445940785306adc","repo":"golang/go","slug":"rsa-key-too-small","errorCode":null,"errorMessage":"rsa: key too small","messagePattern":"rsa: key too small","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/keygen.go","lineNumber":26,"sourceCode":"\t\"crypto/internal/fips140\"\n\t\"crypto/internal/fips140/bigmod\"\n\t\"crypto/internal/fips140/drbg\"\n\t\"errors\"\n\t\"io\"\n)\n\n// GenerateKey generates a new RSA key pair of the given bit size.\n// bits must be at least 32.\n//\n// It follows the process described at c2sp.org/det-keygen, which is compliant\n// with FIPS 186-5, Appendix A.1, IFC Key Pair Generation and FIPS 186-5,\n// Appendix A.1.3, Generation of Random Primes that are Probably Prime.\n// The prime candidates are drawn from rand, which in production will be the\n// global DRBG, while in tests can be an HMAC_DRBG as specified in\n// c2sp.org/det-keygen, to allow using its tests vectors.\nfunc GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {\n\tif bits < 32 {\n\t\treturn nil, errors.New(\"rsa: key too small\")\n\t}\n\tfips140.RecordApproved()\n\tif bits < 2048 || bits%2 == 1 {\n\t\tfips140.RecordNonApproved()\n\t}\n\n\tfor {\n\t\tp, err := randomPrime(rand, (bits+1)/2)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tq, err := randomPrime(rand, bits/2)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tP, err := bigmod.NewModulus(p)\n\t\tif err != nil {","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/keygen.go#L8-L44","documentation":"RSA key generation via GenerateKey requires at least 32 bits. This is the absolute floor below which the prime generation and modular arithmetic become meaningless. Note that 32 bits is far below any security standard — keys under 2048 bits are recorded as non-approved for FIPS purposes but are still generated (the function only hard-rejects below 32).","triggerScenarios":"Calling rsa.GenerateKey(rand, bits) with bits < 32.","commonSituations":"bits read from a misconfigured constant or environment variable defaulting to a small value; a unit test using a deliberately small key for speed that accidentally goes below 32; arithmetic error computing the bit size (e.g., bytes vs bits confusion).","solutions":["Use a minimum of 2048 bits for production keys (3072 or 4096 recommended for new deployments)","Validate bits >= 2048 (or your security policy minimum) before calling GenerateKey","For tests, use at least 32 bits (128 or 256 recommended for speed while staying valid)"],"exampleFix":"// before\nkey, err := rsa.GenerateKey(rand, bits)\n\n// after\nif bits < 2048 {\n    return nil, fmt.Errorf(\"RSA key size must be at least 2048 bits, got %d\", bits)\n}\nkey, err := rsa.GenerateKey(rand, bits)","handlingStrategy":"validation","validationCode":"func validateRSAKeySize(bits int) error {\n    if bits < 2048 {\n        return fmt.Errorf(\"RSA key size must be at least 2048 bits, got %d\", bits)\n    }\n    if bits%2 == 1 {\n        return fmt.Errorf(\"RSA key size must be even, got %d\", bits)\n    }\n    return nil\n}\n\nif err := validateRSAKeySize(bits); err != nil { return err }\nkey, err := rsa.GenerateKey(rand, bits)","typeGuard":null,"tryCatchPattern":"key, err := rsa.GenerateKey(rand, bits)\nif err != nil {\n    return fmt.Errorf(\"RSA key generation failed: %w\", err)\n}","preventionTips":["Enforce a minimum of 2048 bits at the application layer (the library floor of 32 is not a security recommendation)","Use 3072 or 4096 bits for new deployments per current NIST guidance","For tests, use at least 2048 bits or mock the RSA operations for speed"],"tags":["crypto","fips140","rsa","key-generation","input-validation"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}