{"record":{"id":"bdfef4c820fc2045","repo":"golang/go","slug":"crypto-rsa-message-too-long-for-rsa-key-size","errorCode":null,"errorMessage":"crypto/rsa: message too long for RSA key size","messagePattern":"crypto/rsa: message too long for RSA key size","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/rsa.go","lineNumber":383,"sourceCode":"\n// Encrypt performs the RSA public key operation.\nfunc Encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\tif _, err := checkPublicKey(pub); err != nil {\n\t\treturn nil, err\n\t}\n\treturn encrypt(pub, plaintext)\n}\n\nfunc encrypt(pub *PublicKey, plaintext []byte) ([]byte, error) {\n\tm, err := bigmod.NewNat().SetBytes(plaintext, pub.N)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn bigmod.NewNat().ExpShortVarTime(m, uint(pub.E), pub.N).Bytes(pub.N), nil\n}\n\nvar ErrMessageTooLong = errors.New(\"crypto/rsa: message too long for RSA key size\")\nvar ErrDecryption = errors.New(\"crypto/rsa: decryption error\")\nvar ErrVerification = errors.New(\"crypto/rsa: verification error\")\n\nconst withCheck = true\nconst noCheck = false\n\n// DecryptWithoutCheck performs the RSA private key operation.\nfunc DecryptWithoutCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\treturn decrypt(priv, ciphertext, noCheck)\n}\n\n// DecryptWithCheck performs the RSA private key operation and checks the\n// result to defend against errors in the CRT computation.\nfunc DecryptWithCheck(priv *PrivateKey, ciphertext []byte) ([]byte, error) {\n\tfips140.RecordNonApproved()\n\treturn decrypt(priv, ciphertext, withCheck)\n}","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/rsa.go#L365-L401","documentation":"ErrMessageTooLong: the plaintext, interpreted as a big-endian unsigned integer, is greater than or equal to the modulus N. The encrypt path does bigmod.NewNat().SetBytes(plaintext, pub.N), which rejects any input whose byte length exceeds N's byte length (or whose value is >= N). Raw RSA can only encode a number strictly less than N.","triggerScenarios":"Calling fips140/rsa.Encrypt (or the higher-level rsa.EncryptOAEP / raw encrypt) with a plaintext byte slice that is too large for the key size. For a 2048-bit key the raw byte budget is 256 bytes; with OAEP it shrinks by 2*hashLen+2.","commonSituations":"Trying to RSA-encrypt a full document, JSON blob, or symmetric key that is too long; using a 1024-bit (legacy) key with a 128+ byte payload; forgetting that OAEP/SignerPKCS1v15 add padding overhead; passing a session ticket instead of just a 32-byte AES key.","solutions":["Switch to hybrid encryption: encrypt a random 32-byte AES key with RSA, encrypt the payload with AES-GCM.","If using RSA directly, ensure len(plaintext) <= k - 2*hashLen - 2 for OAEP (k = byte length of modulus).","Use a larger RSA key only if absolutely necessary (e.g. 4096-bit) — but hybrid is almost always the right answer.","Check len(plaintext) against the modulus byte length before calling Encrypt and return a clear application-level error."],"exampleFix":"// before\nciphertext, err := rsa.EncryptOAEP(sha256.New(), rand, pub, largeBlob, nil)\n// after\nkey := make([]byte, 32)\nrand.Read(key)\nwrapped, _ := rsa.EncryptOAEP(sha256.New(), rand, pub, key, nil)\nct := aesgcm.Seal(nil, nonce, largeBlob, nil) // AES-GCM","handlingStrategy":"validation","validationCode":"k := (pub.N.BitLen() + 7) / 8 // modulus byte length\nmaxPlain := k - 2*sha256.Size - 2 // OAEP budget\nif len(plaintext) > maxPlain {\n    return errors.New(\"plaintext too long; use hybrid encryption\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never RSA-encrypt arbitrary-size payloads; use RSA only to wrap a 32-byte symmetric key.","Compute the OAEP budget (k - 2*hashLen - 2) up front and enforce it.","Default to AES-GCM + RSA-OAEP hybrid for any non-trivial ciphertext."],"tags":["crypto","rsa","encryption","input-size","go-stdlib"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}