{"record":{"id":"bbe28dab7c50c5e5","repo":"golang/go","slug":"crypto-rsa-use-of-primes-of-different-sizes-is-no","errorCode":null,"errorMessage":"crypto/rsa: use of primes of different sizes is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of primes of different sizes is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/fips.go","lineNumber":469,"sourceCode":"\t}\n\tif pub.E&1 == 0 {\n\t\treturn errors.New(\"crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n\nfunc checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {\n\tif !fips140only.Enforced() {\n\t\treturn nil\n\t}\n\tif err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {\n\t\treturn err\n\t}\n\tif len(priv.Primes) != 2 {\n\t\treturn errors.New(\"crypto/rsa: use of multi-prime keys is not allowed in FIPS 140-only mode\")\n\t}\n\tif priv.Primes[0] == nil || priv.Primes[1] == nil || priv.Primes[0].BitLen() != priv.Primes[1].BitLen() {\n\t\treturn errors.New(\"crypto/rsa: use of primes of different sizes is not allowed in FIPS 140-only mode\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":451,"sourceCodeEnd":473,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/fips.go#L451-L473","documentation":"Thrown by checkFIPS140OnlyPrivateKey when FIPS 140-only mode (GODEBUG=fips140=only) is active and a private key carries two primes whose bit lengths differ, or where one of Primes[0]/Primes[1] is nil. FIPS 140-3 requires the two RSA primes to be of equal length, so the standard library refuses to use such a key for any private-key operation under that mode. The check is applied during key validation/import paths (e.g. via NewPrivateKey / Precompute / Validate) in FIPS-only builds.","triggerScenarios":"Load a legacy PKCS#1/PKCS#8 RSA key whose p and q differ in length while GODEBUG=fips140=only is set; or manually construct a PrivateKey with Primes[0].BitLen() != Primes[1].BitLen(); or feed a key where one prime slice element is nil into a private-key operation under FIPS-only mode.","commonSituations":"Migrating an old keyring generated by non-Go tooling (e.g. OpenSSL with a stripped leading zero in one prime, or hand-tuned keys) into a FIPS-only Go service; loading test fixtures crafted for non-FIPS builds; reading keys from PEM/DER that came from hardware tokens that emit asymmetric primes.","solutions":["Regenerate the key with rsa.GenerateKey(rand.Reader, 2048) (or 3072/4096) — it always produces equal-length primes.","If you must keep an existing key, rebuild the binary without GODEBUG=fips140=only (drop the fips140=only setting) so non-approved keys are tolerated.","Re-import the key via crypto/x509.ParsePKCS1PrivateKey / ParsePKCS8PrivateKey and then validate with priv.Validate() before use; replace the key if validation surfaces prime problems.","Audit upstream key sources (HSM, KMS, JWK export) to ensure they emit equal-bit-length primes."],"exampleFix":"// before: loading a key with mismatched prime lengths under FIPS-only\npriv, _ := x509.ParsePKCS1PrivateKey(raw) // raw has |p| != |q| bits\nplaintext, err := rsa.DecryptOAEP(sha256.New(), rand.Reader, priv, ct, nil) // err: primes of different sizes\n\n// after: regenerate a FIPS-compatible key\npriv, _ := rsa.GenerateKey(rand.Reader, 2048)","handlingStrategy":"validation","validationCode":"// Run before using a private key under FIPS-only mode.\nfunc checkFIPSKey(priv *rsa.PrivateKey) error {\n    if len(priv.Primes) != 2 || priv.Primes[0] == nil || priv.Primes[1] == nil {\n        return errors.New(\"key must have exactly two non-nil primes for FIPS-only\")\n    }\n    if priv.Primes[0].BitLen() != priv.Primes[1].BitLen() {\n        return errors.New(\"primes must be equal bit length for FIPS-only\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate keys with rsa.GenerateKey — it always yields equal-bit-length primes.","Gate FIPS-only imports behind a CI job that runs priv.Validate() before the binary ships.","Document which KMS/HSM export formats are approved for your FIPS-only deployment."],"tags":["fips","rsa","crypto","key-validation","fips140-only"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}