{"record":{"id":"d2adc93c2741e9ab","repo":"golang/go","slug":"invalid-asn-1-from-signasn1","errorCode":null,"errorMessage":"invalid ASN.1 from SignASN1","messagePattern":"invalid ASN\\.1 from SignASN1","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/crypto/ecdsa/ecdsa_legacy.go","lineNumber":83,"sourceCode":"// The signature is randomized. Since Go 1.26, a secure source of random bytes\n// is always used, and the Reader is ignored unless GODEBUG=cryptocustomrand=1\n// is set. This setting will be removed in a future Go release. Instead, use\n// [testing/cryptotest.SetGlobalRandom].\nfunc Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err error) {\n\tsig, err := SignASN1(rand, priv, hash)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tr, s = new(big.Int), new(big.Int)\n\tvar inner cryptobyte.String\n\tinput := cryptobyte.String(sig)\n\tif !input.ReadASN1(&inner, asn1.SEQUENCE) ||\n\t\t!input.Empty() ||\n\t\t!inner.ReadASN1Integer(r) ||\n\t\t!inner.ReadASN1Integer(s) ||\n\t\t!inner.Empty() {\n\t\treturn nil, nil, errors.New(\"invalid ASN.1 from SignASN1\")\n\t}\n\treturn r, s, nil\n}\n\nfunc signLegacy(priv *PrivateKey, csprng io.Reader, hash []byte) (sig []byte, err error) {\n\tif fips140only.Enforced() {\n\t\treturn nil, errors.New(\"crypto/ecdsa: use of custom curves is not allowed in FIPS 140-only mode\")\n\t}\n\n\tc := priv.Curve\n\n\t// A cheap version of hedged signatures, for the deprecated path.\n\tvar seed [32]byte\n\tif _, err := io.ReadFull(csprng, seed[:]); err != nil {\n\t\treturn nil, err\n\t}\n\tfor i, b := range priv.D.Bytes() {\n\t\tseed[i%32] ^= b","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/ecdsa/ecdsa_legacy.go#L65-L101","documentation":"Thrown by the r,s-from-sig re-parser in ecdsa_legacy.go:83 when the signature bytes returned by the FIPS SignASN1 do not reparse as a clean SEQUENCE { INTEGER r, INTEGER s }. This is effectively an internal consistency failure: the library just produced bytes that fail cryptobyte ASN.1 validation. It should not be reachable in normal operation.","triggerScenarios":"Reaching this requires the FIPS SignASN1 path to return bytes that are not a well-formed ECDSA-Sig-Value ASN.1 structure. In practice only seen with a corrupted build, a buggy nistec/fips shim, or memory corruption — never with correct inputs.","commonSituations":"Reproduce only under a broken FIPS backend, mismatched internal package versions after a partial upgrade, or fuzzing that hit an unexpected nistec state.","solutions":["Rebuild with a clean, consistent toolchain (go clean -cache; go build) to rule out stale/partially-compiled crypto packages.","Report as a bug to the Go/crypto maintainers with a reproducer if it persists with valid inputs — this path is an invariant check, not an input error.","Ensure GOEXPERIMENT=fips140 toolchain matches the stdlib version (no mixing of versions)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"r, s, err := ecdsa.SignLegacyToRS(...) // or equivalent ASN.1 reparse\nif err != nil {\n    if strings.Contains(err.Error(), \"invalid ASN.1 from SignASN1\") {\n        // internal invariant failure: clean rebuild, report upstream\n        _ = goCleanCache()\n    }\n    return err\n}","preventionTips":["Keep the toolchain and stdlib versions consistent — do not mix partial crypto package builds.","Run go clean -cache if you see this after a toolchain upgrade.","Treat this error as a bug report, not an input validation issue."],"tags":["go","crypto","ecdsa","asn1","internal"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}