crypto/pbkdf2: use of keys shorter than 112 bits is not allo

Error message

crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

What it means

Returned by pbkdf2.Key when FIPS 140-only mode is enforced and the requested keyLength is less than 14 bytes (112 bits). SP 800-132 / FIPS guidance disallows short derived keys as they fall below the minimum security strength for approval. The check runs only under fips140only.Enforced().

Source

Thrown at src/crypto/pbkdf2/pbkdf2.go:44

// For example, to use a HMAC-SHA-1 based PBKDF2 key derivation function, you
// can get a derived key for e.g. AES-256 (which needs a 32-byte key) by
// doing:
//
//	dk, err := pbkdf2.Key(sha1.New, "some password", salt, 4096, 32)
//
// Remember to get a good random salt. At least 8 bytes is recommended by the
// RFC.
//
// Using a higher iteration count will increase the cost of an exhaustive
// search but will also make derivation proportionally slower.
//
// keyLength must be a positive integer between 1 and (2^32 - 1) * h.Size().
// Setting keyLength to a value outside of this range will result in an error.
func Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {
	fh := fips140hash.UnwrapNew(h)
	if fips140only.Enforced() {
		if keyLength < 112/8 {
			return nil, errors.New("crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode")
		}
		if len(salt) < 128/8 {
			return nil, errors.New("crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode")
		}
		if !fips140only.ApprovedHash(fh()) {
			return nil, errors.New("crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
		}
	}
	return pbkdf2.Key(fh, password, salt, iter, keyLength)
}

View on GitHub (pinned to b6b368adc5)

Solutions

Increase keyLength to at least 14 (112 bits): pbkdf2.Key(sha256.New, pass, salt, iter, 16).
Prefer 256-bit (32-byte) or stronger keys for new designs.
If a short key is truly required, run outside FIPS-only mode (non-FIPS build) and document the risk.

Example fix

// before
dk, err := pbkdf2.Key(sha256.New, pass, salt, 100000, 8) // FIPS error

// after
dk, err := pbkdf2.Key(sha256.New, pass, salt, 100000, 32)

Defensive patterns

Strategy: validation

Validate before calling

const minKeyLen = 14 // 112 bits
if fips140only.Enforced() && keyLength < minKeyLen {
    return nil, errors.New("key too short for FIPS mode")
}
return pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)

Type guard

func isFipsSafeKeyLen(n int) bool { return n >= 14 }

Try / catch

dk, err := pbkdf2.Key(h, pass, salt, iter, keyLength)
if err != nil && strings.Contains(err.Error(), "shorter than 112 bits") {
    dk, err = pbkdf2.Key(h, pass, salt, iter, 32) // bump to 256 bits
}
return dk, err

Prevention

Default to 32-byte derived keys for new code.
Centralize FIPS-mode policy checks in a single wrapper.
Document the 112-bit minimum anywhere key length is configurable.

When it happens

Trigger: Building in FIPS-only mode and calling pbkdf2.Key(h, pass, salt, iter, keyLength) with keyLength < 14. Requesting a small derived key (e.g., 8 bytes) for legacy compatibility.

Common situations: Migrating an app to FIPS-only builds that previously derived short keys. Defaulting keyLength to a small value (e.g., 8) for cache keys or tokens.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/c99d05940f1f8dc6. Report an issue: GitHub.