{"record":{"id":"d281b2898e827e55","repo":"golang/go","slug":"crypto-pbkdf2-use-of-salts-shorter-than-128-bits","errorCode":null,"errorMessage":"crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode","messagePattern":"crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/pbkdf2/pbkdf2.go","lineNumber":47,"sourceCode":"//\n//\tdk, err := pbkdf2.Key(sha1.New, \"some password\", salt, 4096, 32)\n//\n// Remember to get a good random salt. At least 8 bytes is recommended by the\n// RFC.\n//\n// Using a higher iteration count will increase the cost of an exhaustive\n// search but will also make derivation proportionally slower.\n//\n// keyLength must be a positive integer between 1 and (2^32 - 1) * h.Size().\n// Setting keyLength to a value outside of this range will result in an error.\nfunc Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {\n\tfh := fips140hash.UnwrapNew(h)\n\tif fips140only.Enforced() {\n\t\tif keyLength < 112/8 {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tif len(salt) < 128/8 {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode\")\n\t\t}\n\t\tif !fips140only.ApprovedHash(fh()) {\n\t\t\treturn nil, errors.New(\"crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode\")\n\t\t}\n\t}\n\treturn pbkdf2.Key(fh, password, salt, iter, keyLength)\n}\n","sourceCodeStart":29,"sourceCodeEnd":55,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/pbkdf2/pbkdf2.go#L29-L55","documentation":"Returned by pbkdf2.Key in FIPS 140-only mode when the salt is shorter than 16 bytes (128 bits). SP 800-132 mandates salts of at least 128 bits for approved PBKDF2 use; the Go module enforces this. The check triggers only when fips140only.Enforced() is true.","triggerScenarios":"Calling pbkdf2.Key with a salt of fewer than 16 bytes in a FIPS-only build. Reusing a short hardcoded salt from a pre-FIPS design.","commonSituations":"Legacy apps with a fixed short salt migrated into FIPS mode. Generating salt from a weak source that yields < 16 bytes. Test fixtures with minimal salts.","solutions":["Generate at least 16 bytes of salt: salt := make([]byte, 16); crypto/rand.Read(salt).","Use a longer salt (32 bytes) for stronger defense and future margin.","If bound to a legacy short salt, run outside FIPS-only mode with documented rationale."],"exampleFix":"// before\nsalt := []byte(\"salt\") // 4 bytes\ndk, err := pbkdf2.Key(sha256.New, pass, salt, iter, 32) // FIPS error\n\n// after\nsalt := make([]byte, 16)\nrand.Read(salt)\ndk, err := pbkdf2.Key(sha256.New, pass, salt, iter, 32)","handlingStrategy":"validation","validationCode":"const minSaltLen = 16 // 128 bits\nif fips140only.Enforced() && len(salt) < minSaltLen {\n    salt = make([]byte, 16)\n    crypto/rand.Read(salt)\n}\nreturn pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)","typeGuard":"func isFipsSafeSalt(s []byte) bool { return len(s) >= 16 }","tryCatchPattern":"dk, err := pbkdf2.Key(h, pass, salt, iter, keyLength)\nif err != nil && strings.Contains(err.Error(), \"salts shorter than 128 bits\") {\n    salt = make([]byte, 16)\n    crypto/rand.Read(salt)\n    dk, err = pbkdf2.Key(h, pass, salt, iter, keyLength)\n}\nreturn dk, err","preventionTips":["Always generate salts with crypto/rand at 16+ bytes.","Never hardcode short legacy salts.","Persist the generated salt alongside the derived key."],"tags":["cryptography","go","pbkdf2","fips140","salt","compliance"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}