{"record":{"id":"9dceefb9a8d07f7a","repo":"golang/go","slug":"crypto-rsa-multi-prime-rsa-is-not-allowed-in-fips","errorCode":null,"errorMessage":"crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":440,"sourceCode":"//\n// This package does not implement CRT optimizations for multi-prime RSA, so the\n// keys with more than two primes will have worse performance.\n//\n// Since Go 1.26, a secure source of random bytes is always used, and the Reader is\n// ignored unless GODEBUG=cryptocustomrand=1 is set. This setting will be removed\n// in a future Go release. Instead, use [testing/cryptotest.SetGlobalRandom].\n//\n// Deprecated: The use of this function with a number of primes different from\n// two is not recommended for the above security, compatibility, and performance\n// reasons. Use [GenerateKey] instead.\n//\n// [On the Security of Multi-prime RSA]: http://www.cacr.math.uwaterloo.ca/techreports/2006/cacr2006-16.pdf\nfunc GenerateMultiPrimeKey(random io.Reader, nprimes int, bits int) (*PrivateKey, error) {\n\tif nprimes == 2 {\n\t\treturn GenerateKey(random, bits)\n\t}\n\tif fips140only.Enforced() {\n\t\treturn nil, errors.New(\"crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only mode\")\n\t}\n\n\trandom = rand.CustomReader(random)\n\n\tpriv := new(PrivateKey)\n\tpriv.E = 65537\n\n\tif nprimes < 2 {\n\t\treturn nil, errors.New(\"crypto/rsa: GenerateMultiPrimeKey: nprimes must be >= 2\")\n\t}\n\n\tif bits < 64 {\n\t\tprimeLimit := float64(uint64(1) << uint(bits/nprimes))\n\t\t// pi approximates the number of primes less than primeLimit\n\t\tpi := primeLimit / (math.Log(primeLimit) - 1)\n\t\t// Generated primes start with 11 (in binary) so we can only\n\t\t// use a quarter of them.\n\t\tpi /= 4","sourceCodeStart":422,"sourceCodeEnd":458,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L422-L458","documentation":"Returned by GenerateMultiPrimeKey when FIPS 140-only mode is active and nprimes != 2. Multi-prime RSA (more than two primes) is not in the FIPS 140-3 approved algorithm set, and even the nprimes==2 case is redirected to GenerateKey at the top of the function, so any call that actually reaches the multi-prime code path is rejected. The function is also Deprecated for general use.","triggerScenarios":"Call rsa.GenerateMultiPrimeKey(rand.Reader, 3, 2048) under GODEBUG=fips140=only; legacy library (e.g. some BouncyCastle interop) that requests 3- or 4-prime keys.","commonSituations":"Migrating an existing multi-prime-RSA workload into a FIPS-only Go service; test fixtures originally designed to exercise multi-prime paths.","solutions":["Replace with rsa.GenerateKey(rand.Reader, bits) (which is 2-prime and FIPS-eligible).","If multi-prime RSA is mandated by a peer, you cannot comply with FIPS-only — escalate the protocol choice.","Stop using GenerateMultiPrimeKey entirely; it is Deprecated."],"exampleFix":"// before (under GODEBUG=fips140=only)\npriv, err := rsa.GenerateMultiPrimeKey(rand.Reader, 3, 2048) // err: multi-prime RSA is not allowed\n\n// after\npriv, err := rsa.GenerateKey(rand.Reader, 2048)","handlingStrategy":"fallback","validationCode":"// Always prefer GenerateKey; multi-prime is deprecated and FIPS-incompatible.\nfunc generate(bits int) (*rsa.PrivateKey, error) {\n    return rsa.GenerateKey(rand.Reader, bits)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remove GenerateMultiPrimeKey from the codebase; it is Deprecated.","Lint against GenerateMultiPrimeKey usage.","For peer protocols requiring multi-prime RSA, escalate — FIPS-only mode cannot comply."],"tags":["fips","rsa","multi-prime","key-generation","deprecated","fips140-only","crypto"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}