crypto/hkdf: use of keys shorter than 112 bits is not allowe

Error message

crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

What it means

Thrown by checkFIPS140Only (hkdf.go:78) when FIPS 140-only mode is active and the input key (PRK or secret) is shorter than 112 bits (14 bytes). FIPS 140 SP 800-131A mandates a minimum 112-bit security strength; keys below that threshold are not approved.

Source

Thrown at src/crypto/hkdf/hkdf.go:78

	fh := fips140hash.UnwrapNew(h)
	if err := checkFIPS140Only(fh, secret); err != nil {
		return nil, err
	}

	limit := fh().Size() * 255
	if keyLength > limit {
		return nil, errors.New("hkdf: requested key length too large")
	}

	return hkdf.Key(fh, secret, salt, info, keyLength), nil
}

func checkFIPS140Only[Hash hash.Hash](h func() Hash, key []byte) error {
	if !fips140only.Enforced() {
		return nil
	}
	if len(key) < 112/8 {
		return errors.New("crypto/hkdf: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode")
	}
	if !fips140only.ApprovedHash(h()) {
		return errors.New("crypto/hkdf: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
	}
	return nil
}

View on GitHub (pinned to b6b368adc5)

Solutions

Provide a key/secret of at least 14 bytes (112 bits); run a weak secret through HKDF-Extract or a KDF (Argon2/scrypt) first to reach the strength floor.
Disable FIPS 140-only mode if a short input is unavoidable and compliance is not required.
Audit HKDF inputs at the trust boundary to enforce len(key) >= 14 under FIPS builds.

Example fix

// before
prk := []byte("short") // 5 bytes < 14
key, err := hkdf.Expand(sha256.New, prk, "", 32) // FIPS-only -> error 257

// after
prk := make([]byte, 32) // >= 14 bytes; sourced from a strong KDF
key, err := hkdf.Expand(sha256.New, prk, "", 32)

Defensive patterns

Strategy: validation

Validate before calling

if fips140only.Enforced() && len(key) < 14 {
    return errors.New("HKDF input key must be >= 112 bits in FIPS 140-only mode")
}

Type guard

func hkdfKeyMeetsFIPS(key []byte) bool {
    return !fips140only.Enforced() || len(key) >= 14
}

Prevention

Feed HKDF a PRK/secret of at least 14 bytes (112 bits).
Run weak secrets through HKDF-Extract or Argon2/scrypt first.
Disable FIPS mode only if a short input is unavoidable.

When it happens

Trigger: Calling hkdf.Expand/Key with a pseudorandomKey/secret shorter than 14 bytes while fips140only.Enforced(). Common with low-entropy shared secrets, short PINs, or test vectors.

Common situations: FIPS-validated build using a short password/secret as HKDF input; hard-coded test keys; deriving from a 64/128-bit value without prior extraction.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/3c3b20976e909a0c. Report an issue: GitHub.