{"record":{"id":"d201c33f7cb8923c","repo":"golang/go","slug":"crypto-rsa-public-exponent-too-small-or-negative","errorCode":null,"errorMessage":"crypto/rsa: public exponent too small or negative","messagePattern":"crypto/rsa: public exponent too small or negative","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/rsa/rsa.go","lineNumber":344,"sourceCode":"func checkPublicKey(pub *PublicKey) (fipsApproved bool, err error) {\n\tfipsApproved = true\n\tif pub.N == nil {\n\t\treturn false, errors.New(\"crypto/rsa: missing public modulus\")\n\t}\n\tif pub.N.Nat().IsOdd() == 0 {\n\t\treturn false, errors.New(\"crypto/rsa: public modulus is even\")\n\t}\n\t// FIPS 186-5, Section 5.1: \"This standard specifies the use of a modulus\n\t// whose bit length is an even integer and greater than or equal to 2048\n\t// bits.\"\n\tif pub.N.BitLen() < 2048 {\n\t\tfipsApproved = false\n\t}\n\tif pub.N.BitLen()%2 == 1 {\n\t\tfipsApproved = false\n\t}\n\tif pub.E < 2 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent too small or negative\")\n\t}\n\t// e needs to be coprime with p-1 and q-1, since it must be invertible\n\t// modulo λ(pq). Since p and q are prime, this means e needs to be odd.\n\tif pub.E&1 == 0 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent is even\")\n\t}\n\t// FIPS 186-5, Section 5.5(e): \"The exponent e shall be an odd, positive\n\t// integer such that 2¹⁶ < e < 2²⁵⁶.\"\n\tif pub.E <= 1<<16 {\n\t\tfipsApproved = false\n\t}\n\t// We require pub.E to fit into a 32-bit integer so that we\n\t// do not have different behavior depending on whether\n\t// int is 32 or 64 bits. See also\n\t// https://www.imperialviolet.org/2012/03/16/rsae.html.\n\tif pub.E > 1<<31-1 {\n\t\treturn false, errors.New(\"crypto/rsa: public exponent too large\")\n\t}","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/rsa/rsa.go#L326-L362","documentation":"Thrown by checkPublicKey when the public exponent E < 2. The exponent must be an odd integer >= 3 to be invertible modulo λ(N) (E=1 makes every signature/message identical, E<=0 is meaningless). This guard rejects degenerate exponents before checking oddness and the FIPS bounds (2^16 < e < 2^256).","triggerScenarios":"checkPublicKey tests pub.E < 2 during any RSA operation that validates the public key. Fires for E = 0, 1, or negative values.","commonSituations":"A zero-value rsa.PublicKey with E == 0 used before population. A parse failure that left E unset. A custom builder that copied the wrong field into E. Negative E from a signed-int conversion bug.","solutions":["Set E to 65537 (the conventional value) when constructing the PublicKey, or parse it via x509.","Guard with an E >= 3 and odd check before any RSA operation.","Regenerate the key pair; rsa.GenerateKey sets E = 65537 by default."],"exampleFix":"// before\npub := &rsa.PublicKey{N: n} // E zero-valued to 0\n\n// after\npub := &rsa.PublicKey{N: n, E: 65537}\nif pub.E < 3 || pub.E&1 == 0 {\n    return errors.New(\"invalid RSA public exponent\")\n}","handlingStrategy":"validation","validationCode":"if pub.E < 3 || pub.E&1 == 0 {\n    return fmt.Errorf(\"invalid RSA public exponent: %d\", pub.E)\n}","typeGuard":"func validPublicExponent(e int) bool { return e >= 3 && e&1 == 1 }","tryCatchPattern":"err := op(pub)\nif err != nil && strings.Contains(err.Error(), \"public exponent too small or negative\") {\n    return err // set E = 65537 or regenerate\n}","preventionTips":["Set E = 65537 when building a PublicKey, or parse via x509.","Never leave E at its zero value.","Guard E >= 3 and odd before any RSA operation."],"tags":["crypto","rsa","public-key","input-validation","go"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}