golang/go · error

crypto/dsa: invalid ParameterSizes

Error message

crypto/dsa: invalid ParameterSizes

What it means

GenerateParameters accepts only four enumerated ParameterSizes values (L1024N160, L2048N224, L2048N256, L3072N256) corresponding to FIPS 186-3 Table 4.2 prime sizes. Any other value falls through the switch to the default branch, returning this error.

Source

Thrown at src/crypto/dsa/dsa.go:91

	// seed doesn't appear to be exported or used by other code and
	// omitting it makes the code cleaner.

	var L, N int
	switch sizes {
	case L1024N160:
		L = 1024
		N = 160
	case L2048N224:
		L = 2048
		N = 224
	case L2048N256:
		L = 2048
		N = 256
	case L3072N256:
		L = 3072
		N = 256
	default:
		return errors.New("crypto/dsa: invalid ParameterSizes")
	}

	qBytes := make([]byte, N/8)
	pBytes := make([]byte, L/8)

	q := new(big.Int)
	p := new(big.Int)
	rem := new(big.Int)
	one := new(big.Int)
	one.SetInt64(1)

GeneratePrimes:
	for {
		if _, err := io.ReadFull(rand, qBytes); err != nil {
			return err
		}

		qBytes[len(qBytes)-1] |= 1

View on GitHub (pinned to b6b368adc5)

Solutions

1. Use one of the four named constants: dsa.L1024N160, dsa.L2048N224, dsa.L2048N256, or dsa.L3072N256.
2. Validate a caller-supplied size against the known constants before calling GenerateParameters.
3. Default to L2048N256 (a common modern choice) when none is specified.

Example fix

// before
dsa.GenerateParameters(&params, rand.Reader, ParameterSizes(0))
// after
dsa.GenerateParameters(&params, rand.Reader, dsa.L2048N256)

var validSizes = map[dsa.ParameterSizes]bool{
    dsa.L1024N160: true, dsa.L2048N224: true,
    dsa.L2048N256: true, dsa.L3072N256: true,
}
func genDSAParams(params *dsa.Parameters, rand io.Reader, sizes dsa.ParameterSizes) error {
    if !validSizes[sizes] {
        return fmt.Errorf("unsupported DSA ParameterSizes: %d", sizes)
    }
    return dsa.GenerateParameters(params, rand, sizes)
}

func isValidDSASize(s dsa.ParameterSizes) bool {
    switch s {
    case dsa.L1024N160, dsa.L2048N224, dsa.L2048N256, dsa.L3072N256:
        return true
    }
    return false
}

When it happens

Trigger: Calling dsa.GenerateParameters with a ParameterSizes value outside the four defined constants, e.g. an untyped integer cast or a zero value (0, which is not a valid constant).

Common situations: Passing 0 because the ParameterSizes field was not initialized; casting an arbitrary int; using a value computed from input without validation.

Related errors

• crypto/dsa: invalid public key
• crypto/dsa: parameters not set up before generating key
• crypto/dsa: use of DSA is not allowed in FIPS 140-only mode
• crypto/ecdh: private key and public key curves do not match
• crypto/ecdh: invalid private key

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/0b7dd6bc339f8b39. Report an issue: GitHub.