crypto/pbkdf2: use of keys shorter than 112 bits is not…

Error message

crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

What it means

Returned by pbkdf2.Key when FIPS 140-only mode is enforced and the requested keyLength is less than 14 bytes (112 bits). SP 800-132 / FIPS guidance disallows short derived keys as they fall below the minimum security strength for approval. The check runs only under fips140only.Enforced().

Solutions

Increase keyLength to at least 14 (112 bits): pbkdf2.Key(sha256.New, pass, salt, iter, 16).
Prefer 256-bit (32-byte) or stronger keys for new designs.
If a short key is truly required, run outside FIPS-only mode (non-FIPS build) and document the risk.

Example fix

// before
dk, err := pbkdf2.Key(sha256.New, pass, salt, 100000, 8) // FIPS error

// after
dk, err := pbkdf2.Key(sha256.New, pass, salt, 100000, 32)

Defensive patterns

Strategy: validation

Validate before calling

const minKeyLen = 14 // 112 bits
if fips140only.Enforced() && keyLength < minKeyLen {
    return nil, errors.New("key too short for FIPS mode")
}
return pbkdf2.Key(sha256.New, pass, salt, iter, keyLength)

Type guard

func isFipsSafeKeyLen(n int) bool { return n >= 14 }

Try / catch

dk, err := pbkdf2.Key(h, pass, salt, iter, keyLength)
if err != nil && strings.Contains(err.Error(), "shorter than 112 bits") {
    dk, err = pbkdf2.Key(h, pass, salt, iter, 32) // bump to 256 bits
}
return dk, err

Prevention

Default to 32-byte derived keys for new code.
Centralize FIPS-mode policy checks in a single wrapper.
Document the 112-bit minimum anywhere key length is configurable.

When it happens

Trigger: Building in FIPS-only mode and calling pbkdf2.Key(h, pass, salt, iter, keyLength) with keyLength < 14. Requesting a small derived key (e.g., 8 bytes) for legacy compatibility.

Common situations: Migrating an app to FIPS-only builds that previously derived short keys. Defaulting keyLength to a small value (e.g., 8) for cache keys or tokens.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/c99d05940f1f8dc6. Report an issue: GitHub.

Appendix: source

Thrown at src/crypto/pbkdf2/pbkdf2.go:44

// For example, to use a HMAC-SHA-1 based PBKDF2 key derivation function, you
// can get a derived key for e.g. AES-256 (which needs a 32-byte key) by
// doing:
//
//	dk, err := pbkdf2.Key(sha1.New, "some password", salt, 4096, 32)
//
// Remember to get a good random salt. At least 8 bytes is recommended by the
// RFC.
//
// Using a higher iteration count will increase the cost of an exhaustive
// search but will also make derivation proportionally slower.
//
// keyLength must be a positive integer between 1 and (2^32 - 1) * h.Size().
// Setting keyLength to a value outside of this range will result in an error.
func Key[Hash hash.Hash](h func() Hash, password string, salt []byte, iter, keyLength int) ([]byte, error) {
	fh := fips140hash.UnwrapNew(h)
	if fips140only.Enforced() {
		if keyLength < 112/8 {
			return nil, errors.New("crypto/pbkdf2: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode")
		}
		if len(salt) < 128/8 {
			return nil, errors.New("crypto/pbkdf2: use of salts shorter than 128 bits is not allowed in FIPS 140-only mode")
		}
		if !fips140only.ApprovedHash(fh()) {
			return nil, errors.New("crypto/pbkdf2: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
		}
	}
	return pbkdf2.Key(fh, password, salt, iter, keyLength)
}

View on GitHub (pinned to b6b368adc5)