golang/go · error

crypto/md5: use of MD5 is not allowed in FIPS 140-only mode

Error message

crypto/md5: use of MD5 is not allowed in FIPS 140-only mode

What it means

Returned by md5 digest.Write when fips140only.Enforced() is true. In FIPS 140-only mode (GOFIPS=1 with a certified module, or the gofips build tag) the runtime blocks non-approved algorithms: MD5 is not on the FIPS 140 approved list, so any data written to an MD5 digest is rejected. The error is returned from Write, so streaming hashing fails immediately on the first Write call.

Source

Thrown at src/crypto/md5/md5.go:128

}

// New returns a new [hash.Hash] computing the MD5 checksum. The Hash
// also implements [encoding.BinaryMarshaler], [encoding.BinaryAppender] and
// [encoding.BinaryUnmarshaler] to marshal and unmarshal the internal
// state of the hash.
func New() hash.Hash {
	d := new(digest)
	d.Reset()
	return d
}

func (d *digest) Size() int { return Size }

func (d *digest) BlockSize() int { return BlockSize }

func (d *digest) Write(p []byte) (nn int, err error) {
	if fips140only.Enforced() {
		return 0, errors.New("crypto/md5: use of MD5 is not allowed in FIPS 140-only mode")
	}
	// Note that we currently call block or blockGeneric
	// directly (guarded using haveAsm) because this allows
	// escape analysis to see that p and d don't escape.
	nn = len(p)
	d.len += uint64(nn)
	if d.nx > 0 {
		n := copy(d.x[d.nx:], p)
		d.nx += n
		if d.nx == BlockSize {
			if haveAsm {
				block(d, d.x[:])
			} else {
				blockGeneric(d, d.x[:])
			}
			d.nx = 0
		}
		p = p[n:]

View on GitHub (pinned to b6b368adc5)

Solutions

1. Migrate the call site to SHA-256 (or SHA-512) — the FIPS-approved replacement.
2. If MD5 is genuinely needed only as a non-cryptographic checksum, gate it behind a build tag that is never set in FIPS-only deployments, or vendor a non-FIPS md5 implementation.
3. Verify the deployment actually needs FIPS-only mode (GOFIPS=1 vs GOFIPS=0); if FIPS-available (not only) is sufficient, MD5 works.
4. Audit transitive dependencies for hidden MD5 usage (grep for crypto/md5 in go.sum/go.mod).

Example fix

// before
h := md5.New()
io.Copy(h, file) // -> error in FIPS-only mode
// after
h := sha256.New()
io.Copy(h, file)

func isFIPSOnlyEnforced() bool { return fips140only.Enforced() }

// guard before MD5 writes:
if fips140only.Enforced() {
    return errors.New("MD5 unavailable in FIPS-only mode; use SHA-256")
}
h := md5.New()
io.Copy(h, file)

When it happens

Trigger: Calling md5.New() and then Write on the returned hash while the binary is running with FIPS-only enforcement enabled (GOFIPS=1 environment variable pointing at a validated module, or built with the gofips build tag). The first Write returns (0, error).

Common situations: Legacy/deprecated code paths still using MD5 for checksums, ETags, cache keys, or non-cryptographic fingerprints being deployed into a FIPS-required environment (banking, healthcare, US federal); a transitive dependency (e.g. an old HTTP library) computing MD5 internally; CI vs production divergence where CI lacks the FIPS module.

Related errors

• crypto/cipher: use of GCM with arbitrary IVs is not allowed
• crypto/cipher: use of GCM with non-AES ciphers is not allowe
• crypto/des: use of DES is not allowed in FIPS 140-only mode
• crypto/des: use of TripleDES is not allowed in FIPS 140-only
• crypto/dsa: use of DSA is not allowed in FIPS 140-only mode

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/3fd4fdc41d018c18. Report an issue: GitHub.