{"record":{"id":"c0f6e79624d2e4af","repo":"golang/go","slug":"crypto-rsa-verification-error","errorCode":null,"errorMessage":"crypto/rsa: verification error","messagePattern":"crypto/rsa: verification error","errorType":"exception","errorClass":"ErrVerification","httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":549,"sourceCode":"\tif err := priv.Validate(); err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn priv, nil\n}\n\n// ErrMessageTooLong is returned when attempting to encrypt or sign a message\n// which is too large for the size of the key. When using [SignPSS], this can also\n// be returned if the size of the salt is too large.\nvar ErrMessageTooLong = errors.New(\"crypto/rsa: message too long for RSA key size\")\n\n// ErrDecryption represents a failure to decrypt a message.\n// It is deliberately vague to avoid adaptive attacks.\nvar ErrDecryption = errors.New(\"crypto/rsa: decryption error\")\n\n// ErrVerification represents a failure to verify a signature.\n// It is deliberately vague to avoid adaptive attacks.\nvar ErrVerification = errors.New(\"crypto/rsa: verification error\")\n\n// Precompute performs some calculations that speed up private key operations in\n// the future. It is safe to run on non-validated private keys, and it can speed\n// up future calls to [PrivateKey.Validate] for valid keys.\n//\n// Precompute writes to the Precomputed field, so it must not be called\n// concurrently with any other method.\n//\n// Precompute does not return an error. Applications should call\n// [PrivateKey.Validate] after Precompute to check for any problems with the\n// key, including any that would cause Precompute to fail.\n//\n// Calling Precompute on a key that has already been precomputed is a no-op.\nfunc (priv *PrivateKey) Precompute() {\n\tif priv.precomputedIsConsistent() {\n\t\treturn\n\t}\n","sourceCodeStart":531,"sourceCodeEnd":567,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L531-L567","documentation":"ErrVerification is a sentinel error (var) returned by VerifyPKCS1v15 and VerifyPSS when the signature does not validate — wrong public key, wrong hash algorithm, tampered message, or malformed signature encoding. Like ErrDecryption, it is deliberately vague to avoid adaptive signature attacks; callers must not branch on the underlying cause.","triggerScenarios":"rsa.VerifyPKCS1v15(pub, crypto.SHA256, digest, sig) where sig was produced under a different key or with a different hash; rsa.VerifyPSS with mismatched SaltLength between signer and verifier; truncated signature bytes; signature computed over a different digest than the one passed in.","commonSituations":"JWT/RS256 verification with the wrong JWKS key; clock/key-rotation mismatch where the verifier holds a newer pub key than the signer used; wrong hash identifier in a header (SHA-1 vs SHA-256); signature transferred as base64url while decoded as base64.","solutions":["Confirm the public key (kid) matches the signing key before calling Verify*.","Confirm the hash identifier and digest computation match what the signer used (including any canonicalization).","For PSS, ensure opts.SaltLength on the verifier matches the signer's choice (or use rsa.PSSSaltLengthEqualsHash / auto on both sides).","Compare with errors.Is(err, rsa.ErrVerification) and treat all verification failures uniformly."],"exampleFix":"// before\nerr := rsa.VerifyPSS(pub, crypto.SHA256, digest, sig, &rsa.PSSOptions{SaltLength: 64})\nif err != nil {\n    log.Printf(\"sig invalid because: %v\", err) // leaks and is meaningless\n}\n\n// after\nerr := rsa.VerifyPSS(pub, crypto.SHA256, digest, sig, &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash})\nif errors.Is(err, rsa.ErrVerification) {\n    return errors.New(\"signature rejected\")\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := rsa.VerifyPSS(pub, crypto.SHA256, digest, sig, opts)\nif errors.Is(err, rsa.ErrVerification) {\n    return errors.New(\"signature rejected\")\n}","preventionTips":["Match the kid to the right public key before calling Verify*.","Confirm the hash identifier and digest computation match the signer exactly.","Keep PSS SaltLength consistent between signer and verifier (use EqualsHash or auto on both sides)."],"tags":["rsa","verification","signing","pss","pkcs1v15","sentinel","crypto","side-channel"],"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}