{"record":{"id":"c99d05940f1f8dc6","repo":"golang/go","slug":"crypto-pbkdf2-use-of-keys-shorter-than-112-bits-i","errorCode":null,"errorMessage":"crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode","messagePattern":"crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/pbkdf2/pbkdf2.go","lineNumber":44,"sourceCode":"// For example, to use a HMAC-SHA-1 based PBKDF2 key derivation function, you\n// can get a derived key for e.g. AES-256 (which needs a 32-byte key) by\n// doing:\n//\n//\tdk, err := pbkdf2.Key(sha1.New, \"some password\", salt, 4096, 32)\n//\n// Remember to get a good random salt. At least 8 bytes is recommended by the\n// RFC.\n//\n// Using a higher iteration count will increase the cost of an exhaustive\n// search but will also make derivation proportionally slower.\n//\n// keyLength must be a positive integer between 1 and (2^32 - 1) * h.Size().\n// Setting keyLength to a value outside of this range will result in an error.\nfunc Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {\n\tfh := fips140hash.UnwrapNew(h)\n\tif fips140only.Enforced() {\n\t\tif keyLength < 112/8 {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tif len(salt) < 128/8 {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tif !fips140only.ApprovedHash(fh()) {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t\t}\n\t}\n\treturn pbkdf2.Key(fh, password, salt, iter, keyLength)\n}\n","sourceCodeStart":26,"sourceCodeEnd":55,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/pbkdf2/pbkdf2.go#L26-L55","documentation":"Returned by pbkdf2.Key when FIPS 140-only mode is enforced and the requested keyLength is less than 14 bytes (112 bits). SP 800-132 / FIPS guidance disallows short derived keys as they fall below the minimum security strength for approval. The check runs only under fips140only.Enforced().","triggerScenarios":"Building in FIPS-only mode and calling pbkdf2.Key(h, pass, salt, iter, keyLength) with keyLength < 14. Requesting a small derived key (e.g., 8 bytes) for legacy compatibility.","commonSituations":"Migrating an app to FIPS-only builds that previously derived short keys. Defaulting keyLength to a small value (e.g., 8) for cache keys or tokens.","solutions":["Increase keyLength to at least 14 (112 bits): pbkdf2.Key(sha256.New, pass, salt, iter, 16).","Prefer 256-bit (32-byte) or stronger keys for new designs.","If a short key is truly required, run outside FIPS-only mode (non-FIPS build) and document the risk."],"exampleFix":"// before\ndk, err := pbkdf2.Key(sha256.New, pass, salt, 100000, 8) // FIPS error\n\n// after\ndk, err := pbkdf2.Key(sha256.New, pass, salt, 100000, 32)","handlingStrategy":"validation","validationCode":"const minKeyLen = 14 // 112 bits\nif fips140only.Enforced() && keyLength < minKeyLen {\n    return nil, errors.New(\"key too short for FIPS mode\")\n}\nreturn pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)","typeGuard":"func isFipsSafeKeyLen(n int) bool { return n >= 14 }","tryCatchPattern":"dk, err := pbkdf2.Key(h, pass, salt, iter, keyLength)\nif err != nil && strings.Contains(err.Error(), \"shorter than 112 bits\") {\n    dk, err = pbkdf2.Key(h, pass, salt, iter, 32) // bump to 256 bits\n}\nreturn dk, err","preventionTips":["Default to 32-byte derived keys for new code.","Centralize FIPS-mode policy checks in a single wrapper.","Document the 112-bit minimum anywhere key length is configurable."],"tags":["cryptography","go","pbkdf2","fips140","key-derivation","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}