crypto/hkdf: use of hash functions other than SHA-2 or SHA-3

Error message

crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode

What it means

Thrown by checkFIPS140Only (hkdf.go:81) when FIPS 140-only mode is active and the hash function is not an approved SHA-2 or SHA-3 variant (fips140only.ApprovedHash returns false). HKDF built on MD5, SHA-1, BLAKE2, or non-approved hashes is not FIPS-validated.

Source

Thrown at src/crypto/hkdf/hkdf.go:81

	}

	limit := fh().Size() * 255
	if keyLength > limit {
		return nil, errors.New("hkdf: requested key length too large")
	}

	return hkdf.Key(fh, secret, salt, info, keyLength), nil
}

func checkFIPS140Only[Hash hash.Hash](h func() Hash, key []byte) error {
	if !fips140only.Enforced() {
		return nil
	}
	if len(key) < 112/8 {
		return errors.New("crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode")
	}
	if !fips140only.ApprovedHash(h()) {
		return errors.New("crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
	}
	return nil
}

View on GitHub (pinned to b6b368adc5)

Solutions

Use an approved hash: sha256.New, sha512.New, or a SHA-3 constructor.
Disable FIPS 140-only mode if a non-approved hash is required for legacy interop and compliance is not needed.
Validate the hash is SHA-2/SHA-3 before calling HKDF under FIPS builds.

Example fix

// before
key, err := hkdf.Key(sha1.New, secret, salt, "k", 32) // FIPS-only -> error 258

// after
key, err := hkdf.Key(sha256.New, secret, salt, "k", 32)

Defensive patterns

Strategy: validation

Validate before calling

if fips140only.Enforced() && !fips140only.ApprovedHash(h()) {
    return errors.New("HKDF hash must be SHA-2 or SHA-3 in FIPS 140-only mode")
}

Type guard

func isApprovedHash(h crypto.Hash) bool {
    switch h {
    case crypto.SHA224, crypto.SHA256, crypto.SHA384, crypto.SHA512,
        crypto.SHA3_224, crypto.SHA3_256, crypto.SHA3_384, crypto.SHA3_512:
        return true
    }
    return false
}

Prevention

Use SHA-256/384/512 or SHA-3 for HKDF under FIPS builds.
Disable FIPS mode only if a legacy hash is required.
Document the approved hash list for your callers.

When it happens

Trigger: Calling hkdf.Expand/Key with h = md5.New, sha1.New, or crypto.BLAKE2b_512.New while fips140only.Enforced(). Approved hashes are SHA-224/256/384/512 and SHA3-224/256/384/512.

Common situations: Interop code selecting SHA-1/MD5 for a legacy peer; config pinning a non-approved hash; enabling FIPS mode without auditing the HKDF hash selection.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/870d434502412be3. Report an issue: GitHub.