crypto/rand: use of Prime is not allowed in FIPS 140-only mo

Error message

crypto/rand: use of Prime is not allowed in FIPS 140-only mode

What it means

Returned by crypto/rand.Prime when FIPS 140-only mode is enforced. Prime() is excluded from FIPS approval because it is used to build arbitrary-length primes for non-approved primitives (e.g., DSA, custom DH); the FIPS module therefore blocks it entirely. The guard is the first statement in Prime, before any bit-length validation.

Source

Thrown at src/crypto/rand/util.go:23

package rand

import (
	"crypto/internal/fips140only"
	"crypto/internal/rand"
	"errors"
	"io"
	"math/big"
)

// Prime returns a number of the given bit length that is prime with high probability.
// Prime will return error for any error returned by rand.Read or if bits < 2.
//
// Since Go 1.26, a secure source of random bytes is always used, and the Reader is
// ignored unless GODEBUG=cryptocustomrand=1 is set. This setting will be removed
// in a future Go release. Instead, use [testing/cryptotest.SetGlobalRandom].
func Prime(r io.Reader, bits int) (*big.Int, error) {
	if fips140only.Enforced() {
		return nil, errors.New("crypto/rand: use of Prime is not allowed in FIPS 140-only mode")
	}
	if bits < 2 {
		return nil, errors.New("crypto/rand: prime size must be at least 2-bit")
	}

	r = rand.CustomReader(r)

	b := uint(bits % 8)
	if b == 0 {
		b = 8
	}

	bytes := make([]byte, (bits+7)/8)
	p := new(big.Int)

	for {
		if _, err := io.ReadFull(r, bytes); err != nil {
			return nil, err

View on GitHub (pinned to b6b368adc5)

Solutions

Use an approved primitive for prime-based key generation (e.g., rsa.GenerateKey) instead of rand.Prime directly.
Run the affected code path outside FIPS-only mode if prime generation is genuinely required.
Refactor to avoid ad-hoc prime generation; prefer library-level approved generators.

Example fix

// before (FIPS-only build)
p, err := rand.Prime(rand.Reader, 256) // blocked

// after
key, err := rsa.GenerateKey(rand.Reader, 2048) // approved path

Defensive patterns

Strategy: validation

Validate before calling

if fips140only.Enforced() {
    return nil, errors.New("rand.Prime not allowed in FIPS mode; use rsa.GenerateKey")
}
return rand.Prime(r, bits)

Type guard

func primeAllowed() bool { return !fips140only.Enforced() }

Try / catch

p, err := rand.Prime(r, bits)
if err != nil && strings.Contains(err.Error(), "Prime is not allowed in FIPS 140-only mode") {
    // switch to an approved generator or run outside FIPS mode
    return nil, err
}
return p, err

Prevention

Avoid direct rand.Prime; use approved key-generation primitives.
Detect FIPS-only mode at startup and disable affected features.
Audit the dependency tree for crypto/rand.Prime usage.

When it happens

Trigger: Calling rand.Prime(r, bits) in a binary built with FIPS 140-only enforcement. Importing crypto/rand.Prime indirectly through a higher-level primitive.

Common situations: Generating RSA/DH parameters with rand.Prime in a FIPS-only service. Legacy code using rand.Prime for probabilistic prime generation. Libraries (e.g., crypto/dsa) that internally rely on Prime.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/546ee9c09443cbbb. Report an issue: GitHub.