{"record":{"id":"e95b93908bd04abd","repo":"golang/go","slug":"crypto-rsa-use-of-pkcs-1-v1-5-encryption-is-not-a","errorCode":null,"errorMessage":"crypto/rsa: use of PKCS#1 v1.5 encryption is not allowed in FIPS 140-only mode","messagePattern":"crypto/rsa: use of PKCS#1 v1\\.5 encryption is not allowed in FIPS 140-only mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/rsa/pkcs1v15.go","lineNumber":52,"sourceCode":"\n// EncryptPKCS1v15 encrypts the given message with RSA and the padding\n// scheme from PKCS #1 v1.5.  The message must be no longer than the\n// length of the public modulus minus 11 bytes.\n//\n// The random parameter is used as a source of entropy to ensure that encrypting\n// the same message twice doesn't result in the same ciphertext. Since Go 1.26,\n// a secure source of random bytes is always used, and the Reader is ignored\n// unless GODEBUG=cryptocustomrand=1 is set. This setting will be removed in a\n// future Go release. Instead, use [testing/cryptotest.SetGlobalRandom].\n//\n// Deprecated: PKCS #1 v1.5 encryption is dangerous and should not be used.\n// See [draft-irtf-cfrg-rsa-guidance-05] for more information. Use\n// [EncryptOAEP] and [DecryptOAEP] instead.\n//\n// [draft-irtf-cfrg-rsa-guidance-05]: https://www.ietf.org/archive/id/draft-irtf-cfrg-rsa-guidance-05.html#name-rationale\nfunc EncryptPKCS1v15(random io.Reader, pub *PublicKey, msg []byte) ([]byte, error) {\n\tif fips140only.Enforced() {\n\t\treturn nil, errors.New(\"crypto/rsa: use of PKCS#1 v1.5 encryption is not allowed in FIPS 140-only mode\")\n\t}\n\n\tif err := checkPublicKeySize(pub); err != nil {\n\t\treturn nil, err\n\t}\n\n\tk := pub.Size()\n\tif len(msg) > k-11 {\n\t\treturn nil, ErrMessageTooLong\n\t}\n\n\tif boring.Enabled && rand.IsDefaultReader(random) {\n\t\tbkey, err := boringPublicKey(pub)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn boring.EncryptRSAPKCS1(bkey, msg)\n\t}","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/rsa/pkcs1v15.go#L34-L70","documentation":"Returned by EncryptPKCS1v15 the moment FIPS 140-only mode is enforced. PKCS#1 v1.5 encryption is deterministic-ish and vulnerable to Bleichenbacher-style padding-oracle attacks, so FIPS 140-3 drops it from the approved-algorithm set; the Go library makes the function a hard failure rather than silently operating. The function is also marked Deprecated for non-FIPS reasons (see draft-irtf-cfrg-rsa-guidance).","triggerScenarios":"Call rsa.EncryptPKCS1v15(rand.Reader, pub, msg) in a binary running with GODEBUG=fips140=only; transitively reach it through legacy code that wraps RSA key transport with v1.5 padding; using a third-party library (e.g. older JWT or JWE libs) that internally calls EncryptPKCS1v15.","commonSituations":"A service that previously ran in non-FIPS Go gets rebuilt or redeployed with FIPS-only enabled (compliance mandate) and now fails on existing RSA-encrypted payloads; integration with a peer system that only supports RSAES-PKCS1-v1_5.","solutions":["Switch to rsa.EncryptOAEP(sha256.New(), rand.Reader, pub, msg, nil) — the FIPS-approved replacement.","If the peer only supports PKCS#1 v1.5, renegotiate the protocol (JWE alg from RSA1_5 to RSA-OAEP-256, legacy SAML/XML-Enc profiles, etc.).","As a last resort, drop GODEBUG=fips140=only — but only after a risk review, since it disables FIPS compliance globally."],"exampleFix":"// before\nct, err := rsa.EncryptPKCS1v15(rand.Reader, pub, msg)\n\n// after\nct, err := rsa.EncryptOAEP(sha256.New(), rand.Reader, pub, msg, nil)","handlingStrategy":"fallback","validationCode":"func encryptFIPS(pub *rsa.PublicKey, msg []byte) ([]byte, error) {\n    // Always OAEP — never PKCS1v15.\n    return rsa.EncryptOAEP(sha256.New(), rand.Reader, pub, msg, nil)\n}","typeGuard":null,"tryCatchPattern":"ct, err := rsa.EncryptPKCS1v15(rand.Reader, pub, msg)\nif err != nil {\n    if errors.Is(err, errors.New(\"crypto/rsa: use of PKCS#1 v1.5 encryption is not allowed in FIPS 140-only mode\")) {\n        // fall back to OAEP only if the peer can handle it\n        ct, err = rsa.EncryptOAEP(sha256.New(), rand.Reader, pub, msg, nil)\n    }\n}","preventionTips":["Treat rsa.EncryptPKCS1v15 as deprecated regardless of FIPS mode.","Codify OAEP-only in a project wrapper and lint against direct EncryptPKCS1v15 calls.","In JWE/JWT configs, default alg to RSA-OAEP-256."],"tags":["fips","rsa","pkcs1v15","encryption","deprecated","fips140-only"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}