{"record":{"id":"9cc381c385bc6aa5","repo":"golang/go","slug":"rsa-requested-hash-function-unavailable-hash","errorCode":null,"errorMessage":"rsa: requested hash function unavailable: {hash}","messagePattern":"rsa: requested hash function unavailable: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":180,"sourceCode":"\tif pssOpts, ok := opts.(*PSSOptions); ok {\n\t\treturn SignPSS(rand, priv, pssOpts.Hash, digest, pssOpts)\n\t}\n\n\treturn SignPKCS1v15(rand, priv, opts.HashFunc(), digest)\n}\n\n// Decrypt decrypts ciphertext with priv. If opts is nil or of type\n// *[PKCS1v15DecryptOptions] then PKCS #1 v1.5 decryption is performed. Otherwise\n// opts must have type *[OAEPOptions] and OAEP decryption is done.\nfunc (priv *PrivateKey) Decrypt(rand io.Reader, ciphertext []byte, opts crypto.DecrypterOpts) (plaintext []byte, err error) {\n\tif opts == nil {\n\t\treturn DecryptPKCS1v15(rand, priv, ciphertext)\n\t}\n\n\tswitch opts := opts.(type) {\n\tcase *OAEPOptions:\n\t\tif !opts.Hash.Available() {\n\t\t\treturn nil, errors.New(\"rsa: requested hash function unavailable: \" + opts.Hash.String())\n\t\t}\n\t\tif opts.MGFHash != 0 && !opts.MGFHash.Available() {\n\t\t\treturn nil, errors.New(\"rsa: requested hash function unavailable: \" + opts.MGFHash.String())\n\t\t}\n\t\tif opts.MGFHash == 0 {\n\t\t\treturn decryptOAEP(opts.Hash.New(), opts.Hash.New(), priv, ciphertext, opts.Label)\n\t\t} else {\n\t\t\treturn decryptOAEP(opts.Hash.New(), opts.MGFHash.New(), priv, ciphertext, opts.Label)\n\t\t}\n\n\tcase *PKCS1v15DecryptOptions:\n\t\tif l := opts.SessionKeyLen; l > 0 {\n\t\t\tplaintext = make([]byte, l)\n\t\t\tif _, err := io.ReadFull(rand, plaintext); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tif err := DecryptPKCS1v15SessionKey(rand, priv, ciphertext, plaintext); err != nil {\n\t\t\t\treturn nil, err","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L162-L198","documentation":"Returned by PrivateKey.Decrypt when opts is *rsa.OAEPOptions and opts.Hash.Available() is false. crypto.Hash.Available() reports whether the hash function is linked into the binary; it returns false if the corresponding package (e.g. crypto/sha512) was never imported, which is common when using a hash solely by its identifier. The Decrypt path refuses to proceed because OAEP needs to instantiate the hash to build the MGF and label digest.","triggerScenarios":"Pass &rsa.OAEPOptions{Hash: crypto.SHA512} to Decrypt in a binary that never imports crypto/sha512 (not even blank-imported); reference crypto.SHA3_256/SHAKE without importing crypto/sha3; cross-compile a stripped binary where the hash package was tree-shaken.","commonSituations":"Main package uses rsa.OAEPOptions{Hash: crypto.SHA256} but only because another dependency pulled in crypto/sha256 — removing that dependency suddenly breaks OAEP decryption; using a hash constant obtained from configuration or a remote protocol without ensuring the implementation is present.","solutions":["Blank-import the hash package in your main package: import _ \"crypto/sha512\".","Use a hash that is unconditionally available in your binary (crypto.SHA256 is pulled in by most stacks).","Before calling Decrypt, guard with if !opts.Hash.Available() { ... } and surface a clearer error."],"exampleFix":"// before: SHA512 not linked\nimport (\n    \"crypto\"\n    \"crypto/rsa\"\n)\npt, err := priv.Decrypt(rand.Reader, ct, &rsa.OAEPOptions{Hash: crypto.SHA512})\n\n// after\nimport (\n    \"crypto\"\n    \"crypto/rsa\"\n    _ \"crypto/sha512\"\n)\npt, err := priv.Decrypt(rand.Reader, ct, &rsa.OAEPOptions{Hash: crypto.SHA512})","handlingStrategy":"validation","validationCode":"opts := &rsa.OAEPOptions{Hash: crypto.SHA512}\nif !opts.Hash.Available() {\n    return errors.New(\"hash \" + opts.Hash.String() + \" not linked; import its package\")\n}\nreturn priv.Decrypt(rand.Reader, ct, opts)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Blank-import every hash package you reference by identifier: import _ \"crypto/sha512\".","Centralize hash selection in a helper that also asserts Available().","For stripped binaries, build with -tags that keep hash packages from being tree-shaken."],"tags":["rsa","oaep","hash","linking","crypto"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T08:17:17.861Z"}