{"record":{"id":"9d92943ee179d05d","repo":"golang/go","slug":"crypto-rsa-use-of-even-public-exponent-is-not-all","errorCode":null,"errorMessage":"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/fips.go","lineNumber":453,"sourceCode":"\nfunc checkFIPS140OnlyPublicKey(pub *PublicKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif pub.N == nil {\n\t\treturn errors.New(\"crypto/rsa: public key missing N\")\n\t}\n\tif pub.N.BitLen() < 2048 {\n\t\treturn errors.New(\"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.N.BitLen()%2 == 1 {\n\t\treturn errors.New(\"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E <= 1<<16 {\n\t\treturn errors.New(\"crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode\")\n\t}\n\tif pub.E&1 == 0 {\n\t\treturn errors.New(\"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n\nfunc checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {\n\t\treturn err\n\t}\n\tif len(priv.Primes) != 2 {\n\t\treturn errors.New(\"crypto/rsa: use of multi-prime keys is not allowed in FIPS 140-only mode\")\n\t}\n\tif priv.Primes[0] == nil || priv.Primes[1] == nil || priv.Primes[0].BitLen() != priv.Primes[1].BitLen() {\n\t\treturn errors.New(\"crypto/rsa: use of primes of different sizes is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil","sourceCodeStart":435,"sourceCodeEnd":471,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/fips.go#L435-L471","documentation":"Thrown by checkFIPS140OnlyPublicKey when fips140only.Enforced() and pub.E is even (pub.E & 1 == 0). An even public exponent is mathematically invalid for RSA (gcd(e, phi) != 1 is possible and e must be coprime to (p-1)(q-1)) and FIPS mandates an odd exponent. This check follows the > 2^16 check, so a large even exponent also trips 497 first.","triggerScenarios":"A key with E set to an even value (e.g. 65536, 131072) — usually a bug in key generation or a corrupted/round-tripped key where E was modified. Constructing a PublicKey literal with an even E.","commonSituations":"Deserialization bug that altered E. Test fixtures with placeholder E values. Manually-built keys from a non-standard generator.","solutions":["Regenerate the key with rsa.GenerateKey (E = 65537, which is odd).","Validate at load: if pub.E & 1 == 0 { reject }.","Inspect the key-serialization round-trip if E was correct at generation but even at load."],"exampleFix":"// before\npub := &rsa.PublicKey{N: n, E: 65536} // even, invalid\nerr := rsa.VerifyPSS(pub, crypto.SHA256, digest, sig, opts)\n\n// after\npub := &rsa.PublicKey{N: n, E: 65537} // odd, FIPS-approved\nerr := rsa.VerifyPSS(pub, crypto.SHA256, digest, sig, opts)","handlingStrategy":"validation","validationCode":"if pub.E&1 == 0 {\n    return fmt.Errorf(\"public exponent E=%d is even; FIPS requires an odd exponent (use 65537)\", pub.E)\n}\n// proceed","typeGuard":"func exponentIsOdd(e int) bool { return e&1 == 1 }","tryCatchPattern":null,"preventionTips":["Use 65537 (odd) as the public exponent.","Validate exponent parity at key-load time.","Investigate any key whose E changed between generation and load — likely a serialization bug."],"tags":["crypto","rsa","fips","key-validation","exponent"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}