{"record":{"id":"e260e1145683181c","repo":"golang/go","slug":"crypto-rsa-use-of-keys-smaller-than-2048-bits-is-e260e1","errorCode":null,"errorMessage":"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/rsa.go","lineNumber":362,"sourceCode":"\t\t\t\tN: N,\n\t\t\t\tE: int(e64),\n\t\t\t},\n\t\t\tD:      D,\n\t\t\tPrimes: []*big.Int{P, Q},\n\t\t\tPrecomputed: PrecomputedValues{\n\t\t\t\tDp:        Dp,\n\t\t\t\tDq:        Dq,\n\t\t\t\tQinv:      Qinv,\n\t\t\t\tCRTValues: make([]CRTValue, 0), // non-nil, to match Precompute\n\t\t\t},\n\t\t}\n\t\treturn key, nil\n\t}\n\n\trandom = rand.CustomReader(random)\n\n\tif fips140only.Enforced() && bits < 2048 {\n\t\treturn nil, errors.New(\"crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode\")\n\t}\n\tif fips140only.Enforced() && bits%2 == 1 {\n\t\treturn nil, errors.New(\"crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode\")\n\t}\n\tif fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {\n\t\treturn nil, errors.New(\"crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode\")\n\t}\n\n\tk, err := rsa.GenerateKey(random, bits)\n\tif bits < 256 && err != nil {\n\t\t// Toy-sized keys have a non-negligible chance of hitting two hard\n\t\t// failure cases: p == q and d <= 2^(nlen / 2).\n\t\t//\n\t\t// Since these are impossible to hit for real keys, we don't want to\n\t\t// make the production code path more complex and harder to think about\n\t\t// to handle them.\n\t\t//\n\t\t// Instead, just rerun the whole process a total of 8 times, which","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/rsa.go#L344-L380","documentation":"Returned by GenerateKey when FIPS 140-only mode (GODEBUG=fips140=only) is active and the requested bits is below 2048. FIPS 140-3 SP 800-56Br2 disallows RSA keys under 2048 bits for new key generation, so the FIPS-only path rejects the request before calling the underlying generator. Note this fires before the general checkKeySize floor of 1024, so under FIPS-only mode even 1024/1536-bit requests fail here.","triggerScenarios":"Call rsa.GenerateKey(rand.Reader, 1024) (or any bits<2048) in a binary launched with GODEBUG=fips140=only; tests that historically used small keys now running in FIPS-only CI.","commonSituations":"Enabling FIPS-only compliance on a service that previously generated 1024-bit keys; test suite with t.Setenv(\"GODEBUG\", \"fips140=only\") that still calls GenerateKey with small sizes.","solutions":["Use 2048, 3072, or 4096 bits — these are also the sizes routed through BoringCrypto when available.","For tests, regenerate fixtures at 2048 bits or skip FIPS-only for unit tests that legitimately need toy keys.","If a peer mandates <2048-bit RSA, escalate — FIPS-only mode cannot comply."],"exampleFix":"// before (under GODEBUG=fips140=only)\npriv, err := rsa.GenerateKey(rand.Reader, 1024) // err: smaller than 2048\n\n// after\npriv, err := rsa.GenerateKey(rand.Reader, 2048)","handlingStrategy":"validation","validationCode":"const minBits = 2048\nif bits < minBits {\n    return fmt.Errorf(\"RSA key size %d below FIPS minimum %d\", bits, minBits)\n}\nreturn rsa.GenerateKey(rand.Reader, bits)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on 2048/3072/4096 across services.","Validate key size at the configuration layer, not at the GenerateKey call site.","Update test fixtures to ≥2048-bit keys before enabling FIPS-only CI."],"tags":["fips","rsa","key-generation","fips140-only","crypto"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}