{"record":{"id":"d2727a523e540466","repo":"golang/go","slug":"crypto-ecdsa-use-of-hash-functions-other-than-sha","errorCode":null,"errorMessage":"crypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode","messagePattern":"crypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/ecdsa/ecdsa.go","lineNumber":468,"sourceCode":"\t\treturn signFIPSDeterministic(ecdsa.P384(), h, priv, hash)\n\tcase elliptic.P521().Params():\n\t\treturn signFIPSDeterministic(ecdsa.P521(), h, priv, hash)\n\tdefault:\n\t\treturn nil, errors.New(\"ecdsa: curve not supported by deterministic signatures\")\n\t}\n}\n\nfunc signFIPSDeterministic[P ecdsa.Point[P]](c *ecdsa.Curve[P], hashFunc crypto.Hash, priv *PrivateKey, hash []byte) ([]byte, error) {\n\tk, err := privateKeyToFIPS(c, priv)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif !hashFunc.Available() {\n\t\treturn nil, errors.New(\"ecdsa: requested hash function unavailable: \" + hashFunc.String())\n\t}\n\th := fips140hash.UnwrapNew(hashFunc.New)\n\tif fips140only.Enforced() && !fips140only.ApprovedHash(h()) {\n\t\treturn nil, errors.New(\"crypto/ecdsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t}\n\tsig, err := ecdsa.SignDeterministic(c, h, k, hash)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn encodeSignature(sig.R, sig.S)\n}\n\nfunc encodeSignature(r, s []byte) ([]byte, error) {\n\tvar b cryptobyte.Builder\n\tb.AddASN1(asn1.SEQUENCE, func(b *cryptobyte.Builder) {\n\t\taddASN1IntBytes(b, r)\n\t\taddASN1IntBytes(b, s)\n\t})\n\treturn b.Bytes()\n}\n\n// addASN1IntBytes encodes in ASN.1 a positive integer represented as","sourceCodeStart":450,"sourceCodeEnd":486,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/ecdsa/ecdsa.go#L450-L486","documentation":"Thrown by signFIPSDeterministic when FIPS 140-only mode is enforced and the requested hash function is not a FIPS-approved SHA-2 or SHA-3 variant. FIPS 140 prohibits the use of non-approved hash functions (like MD5, SHA-1, BLAKE2) in cryptographic operations. The fips140only.ApprovedHash check validates the hash implementation against the approved list.","triggerScenarios":"Calling deterministic Sign with opts.HashFunc() set to a non-approved hash (e.g., crypto.MD5, crypto.SHA1, crypto.BLAKE2b_256) while FIPS 140-only mode is active. Even if the hash is technically 'available' (linked), it fails the FIPS approval check.","commonSituations":"FIPS-compliant deployments where legacy code uses SHA-1 or MD5 for signing; migrating to FIPS mode without auditing hash usage; protocols that mandate non-FIPS hashes (some legacy TLS cipher suites use SHA-1).","solutions":["Switch to a FIPS-approved hash: use SHA-224, SHA-256, SHA-384, SHA-512 (SHA-2 family) or SHA3-224/256/384/512 (SHA-3 family).","Audit all deterministic signing call sites when entering FIPS mode and replace non-compliant hashes.","If SHA-1 is required for backward compatibility, it cannot be used in FIPS 140-only mode — negotiate a protocol upgrade to SHA-256."],"exampleFix":"// before\nsig, err := priv.Sign(nil, digest, crypto.SHA1) // rejected in FIPS mode\n\n// after\nsig, err := priv.Sign(nil, digest, crypto.SHA256) // SHA-2 is FIPS-approved","handlingStrategy":"validation","validationCode":"func isFIPSApprovedHash(h crypto.Hash) bool {\n    switch h {\n    case crypto.SHA224, crypto.SHA256, crypto.SHA384, crypto.SHA512,\n         crypto.SHA3_224, crypto.SHA3_256, crypto.SHA3_384, crypto.SHA3_512:\n        return true\n    }\n    return false\n}\n// call before deterministic Sign in FIPS mode","typeGuard":null,"tryCatchPattern":"sig, err := priv.Sign(nil, digest, h)\nif err != nil && strings.Contains(err.Error(), \"SHA-2 or SHA-3\") {\n    // switch to an approved hash and re-hash the original message\n    digest = sha256.Sum256(msg)\n    sig, err = priv.Sign(nil, digest[:], crypto.SHA256)\n}","preventionTips":["In FIPS environments, only use SHA-2 or SHA-3 hashes for signing.","Audit all crypto.Hash constants in signing code paths when enabling FIPS mode."],"tags":["crypto","ecdsa","fips","signing","hash","compliance","rfc6979"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}