{"record":{"id":"bddac12d45826ecf","repo":"golang/go","slug":"crypto-pbkdf2-use-of-hash-functions-other-than-sh","errorCode":null,"errorMessage":"crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode","messagePattern":"crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/pbkdf2/pbkdf2.go","lineNumber":50,"sourceCode":"// Remember to get a good random salt. At least 8 bytes is recommended by the\n// RFC.\n//\n// Using a higher iteration count will increase the cost of an exhaustive\n// search but will also make derivation proportionally slower.\n//\n// keyLength must be a positive integer between 1 and (2^32 - 1) * h.Size().\n// Setting keyLength to a value outside of this range will result in an error.\nfunc Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {\n\tfh := fips140hash.UnwrapNew(h)\n\tif fips140only.Enforced() {\n\t\tif keyLength < 112/8 {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tif len(salt) < 128/8 {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tif !fips140only.ApprovedHash(fh()) {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t\t}\n\t}\n\treturn pbkdf2.Key(fh, password, salt, iter, keyLength)\n}\n","sourceCodeStart":32,"sourceCodeEnd":55,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/pbkdf2/pbkdf2.go#L32-L55","documentation":"Returned by pbkdf2.Key in FIPS 140-only mode when the hash function is not an approved SHA-2 or SHA-3 variant. FIPS-approved PBKDF2 permits only SHA-2 (SHA-224/256/384/512) and SHA-3 family hashes; other hashes (e.g., SHA-1, MD5, BLAKE2) are rejected. The check uses fips140only.ApprovedHash.","triggerScenarios":"Passing a non-approved hash constructor like sha1.New or md5.New to pbkdf2.Key in a FIPS-only build. Using a custom hash.Hash implementation that is not in the approved set.","commonSituations":"Migrating legacy SHA-1-based key derivation into FIPS mode. Selecting BLAKE2b for performance and hitting FIPS restrictions. Third-party libraries that default to SHA-1.","solutions":["Switch to an approved hash: pbkdf2.Key(sha256.New, pass, salt, iter, keyLen).","For higher security use sha512.New or a SHA-3 variant.","If a non-approved hash is mandatory, run outside FIPS-only mode and accept non-compliance."],"exampleFix":"// before\ndk, err := pbkdf2.Key(sha1.New, pass, salt, iter, 32) // FIPS error\n\n// after\ndk, err := pbkdf2.Key(sha256.New, pass, salt, iter, 32)","handlingStrategy":"validation","validationCode":"if fips140only.Enforced() && !fips140only.ApprovedHash(fh()) {\n    return nil, errors.New(\"hash not FIPS-approved; use SHA-2/SHA-3\")\n}\nreturn pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)","typeGuard":"func isApprovedHash(h hash.Hash) bool { return fips140only.ApprovedHash(h) }","tryCatchPattern":"dk, err := pbkdf2.Key(h, pass, salt, iter, keyLength)\nif err != nil && strings.Contains(err.Error(), \"other than SHA-2 or SHA-3\") {\n    dk, err = pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)\n}\nreturn dk, err","preventionTips":["Standardize on SHA-256/SHA-512 for PBKDF2 across the codebase.","Reject user-supplied hash selectors in FIPS builds.","Document the approved-hash allowlist in config schemas."],"tags":["cryptography","go","pbkdf2","fips140","hash-function","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}