golang/go · error

crypto/pbkdf2: use of hash functions other than SHA-2 or SHA

Error message

crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode

What it means

Returned by pbkdf2.Key in FIPS 140-only mode when the hash function is not an approved SHA-2 or SHA-3 variant. FIPS-approved PBKDF2 permits only SHA-2 (SHA-224/256/384/512) and SHA-3 family hashes; other hashes (e.g., SHA-1, MD5, BLAKE2) are rejected. The check uses fips140only.ApprovedHash.

Source

Thrown at src/crypto/pbkdf2/pbkdf2.go:50

// Remember to get a good random salt. At least 8 bytes is recommended by the
// RFC.
//
// Using a higher iteration count will increase the cost of an exhaustive
// search but will also make derivation proportionally slower.
//
// keyLength must be a positive integer between 1 and (2^32 - 1) * h.Size().
// Setting keyLength to a value outside of this range will result in an error.
func Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {
	fh := fips140hash.UnwrapNew(h)
	if fips140only.Enforced() {
		if keyLength < 112/8 {
			return nil, errors.New("crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode")
		}
		if len(salt) < 128/8 {
			return nil, errors.New("crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode")
		}
		if !fips140only.ApprovedHash(fh()) {
			return nil, errors.New("crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
		}
	}
	return pbkdf2.Key(fh, password, salt, iter, keyLength)
}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Switch to an approved hash: pbkdf2.Key(sha256.New, pass, salt, iter, keyLen).
2. For higher security use sha512.New or a SHA-3 variant.
3. If a non-approved hash is mandatory, run outside FIPS-only mode and accept non-compliance.

Example fix

// before
dk, err := pbkdf2.Key(sha1.New, pass, salt, iter, 32) // FIPS error

// after
dk, err := pbkdf2.Key(sha256.New, pass, salt, iter, 32)

if fips140only.Enforced() && !fips140only.ApprovedHash(fh()) {
    return nil, errors.New("hash not FIPS-approved; use SHA-2/SHA-3")
}
return pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)

func isApprovedHash(h hash.Hash) bool { return fips140only.ApprovedHash(h) }

dk, err := pbkdf2.Key(h, pass, salt, iter, keyLength)
if err != nil && strings.Contains(err.Error(), "other than SHA-2 or SHA-3") {
    dk, err = pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)
}
return dk, err

When it happens

Trigger: Passing a non-approved hash constructor like sha1.New or md5.New to pbkdf2.Key in a FIPS-only build. Using a custom hash.Hash implementation that is not in the approved set.

Common situations: Migrating legacy SHA-1-based key derivation into FIPS mode. Selecting BLAKE2b for performance and hitting FIPS restrictions. Third-party libraries that default to SHA-1.

Related errors

• crypto/pbkdf2: use of keys shorter than 112 bits is not allo
• crypto/pbkdf2: use of salts shorter than 128 bits is not all
• crypto/rsa: use of hash functions other than SHA-2 or SHA-3
• crypto/mlkem/mlkemtest: use of derandomized encapsulation is
• crypto/rand: use of Prime is not allowed in FIPS 140-only mo

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/bddac12d45826ecf. Report an issue: GitHub.