What causes "crypto/rand: prime size must be at least 2-bit" in golang/go?

Validate bits >= 2 before calling: if bits < 2 { return errors.New("...") }.

crypto/rand: prime size must be at least 2-bit

Error message

crypto/rand: prime size must be at least 2-bit

What it means

Returned by crypto/rand.Prime when bits < 2. A prime of fewer than 2 bits is mathematically meaningless (the smallest prime is 2, a 2-bit number), so the function rejects it with an explicit error. This check runs after the FIPS guard, so it applies in both FIPS and non-FIPS builds.

Source

Thrown at src/crypto/rand/util.go:26

	"crypto/internal/fips140only"
	"crypto/internal/rand"
	"errors"
	"io"
	"math/big"
)

// Prime returns a number of the given bit length that is prime with high probability.
// Prime will return error for any error returned by rand.Read or if bits < 2.
//
// Since Go 1.26, a secure source of random bytes is always used, and the Reader is
// ignored unless GODEBUG=cryptocustomrand=1 is set. This setting will be removed
// in a future Go release. Instead, use [testing/cryptotest.SetGlobalRandom].
func Prime(r io.Reader, bits int) (*big.Int, error) {
	if fips140only.Enforced() {
		return nil, errors.New("crypto/rand: use of Prime is not allowed in FIPS 140-only mode")
	}
	if bits < 2 {
		return nil, errors.New("crypto/rand: prime size must be at least 2-bit")
	}

	r = rand.CustomReader(r)

	b := uint(bits % 8)
	if b == 0 {
		b = 8
	}

	bytes := make([]byte, (bits+7)/8)
	p := new(big.Int)

	for {
		if _, err := io.ReadFull(r, bytes); err != nil {
			return nil, err
		}

		// Clear bits in the first byte to make sure the candidate has a size <= bits.

View on GitHub (pinned to b6b368adc5)

Solutions

Validate bits >= 2 before calling: if bits < 2 { return errors.New("...") }.
Use standard prime sizes (e.g., 256 for DH q, 1024+ for safe primes).
Clamp configurable input to a safe minimum.

Example fix

// before
p, err := rand.Prime(rand.Reader, 1) // error

// after
if bits < 2 { return fmt.Errorf("bits must be >= 2") }
p, err := rand.Prime(rand.Reader, bits)

Defensive patterns

Strategy: validation

Validate before calling

if bits < 2 {
    return nil, fmt.Errorf("bits must be >= 2, got %d", bits)
}
return rand.Prime(r, bits)

Type guard

func isValidBitLen(b int) bool { return b >= 2 }

Try / catch

p, err := rand.Prime(r, bits)
if err != nil && strings.Contains(err.Error(), "at least 2-bit") {
    return rand.Prime(r, 2)
}
return p, err

Prevention

Clamp configurable bit lengths to a safe minimum before calling Prime.
Validate external inputs feeding the bits parameter.
Test boundary values (2, 3, 8) explicitly.

When it happens

Trigger: Calling rand.Prime(r, 0), rand.Prime(r, 1), or any negative value. Computing bits from an expression that can underflow to 0/1.

Common situations: Parameterizing bit length from untrusted config input. Off-by-one in bit-length arithmetic. Test loops that include degenerate bit sizes.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/8066b1d9f715982f. Report an issue: GitHub.