crypto/rc4: use of RC4 is not allowed in FIPS 140-only mode

Error message

crypto/rc4: use of RC4 is not allowed in FIPS 140-only mode

What it means

Returned by rc4.NewCipher when FIPS 140-only mode is enforced. RC4 is a broken stream cipher disallowed by FIPS 140; the Go module blocks its instantiation in enforced builds as the very first check, before key-size validation. The guard mirrors the broader policy of excluding non-approved legacy algorithms.

Source

Thrown at src/crypto/rc4/rc4.go:35

)

// A Cipher is an instance of RC4 using a particular key.
type Cipher struct {
	s    [256]uint32
	i, j uint8
}

type KeySizeError int

func (k KeySizeError) Error() string {
	return "crypto/rc4: invalid key size " + strconv.Itoa(int(k))
}

// NewCipher creates and returns a new [Cipher]. The key argument should be the
// RC4 key, at least 1 byte and at most 256 bytes.
func NewCipher(key []byte) (*Cipher, error) {
	if fips140only.Enforced() {
		return nil, errors.New("crypto/rc4: use of RC4 is not allowed in FIPS 140-only mode")
	}
	k := len(key)
	if k < 1 || k > 256 {
		return nil, KeySizeError(k)
	}
	var c Cipher
	for i := 0; i < 256; i++ {
		c.s[i] = uint32(i)
	}
	var j uint8 = 0
	for i := 0; i < 256; i++ {
		j += uint8(c.s[i]) + key[i%k]
		c.s[i], c.s[j] = c.s[j], c.s[i]
	}
	return &c, nil
}

// Reset zeros the key data and makes the [Cipher] unusable.

View on GitHub (pinned to b6b368adc5)

Solutions

Replace RC4 with an approved cipher: aes.NewCipher(key) or chacha20.
Run the legacy RC4 path in a non-FIPS build if backwards compatibility is mandatory.
Audit dependencies for crypto/rc4 imports and upgrade/remove them.

Example fix

// before (FIPS-only build)
c, err := rc4.NewCipher(key) // blocked

// after
c, err := aes.NewCipher(keyAES32)

Defensive patterns

Strategy: validation

Validate before calling

if fips140only.Enforced() {
    return nil, errors.New("RC4 blocked in FIPS mode; use AES")
}
return rc4.NewCipher(key)

Type guard

func rc4Allowed() bool { return !fips140only.Enforced() }

Try / catch

c, err := rc4.NewCipher(key)
if err != nil && strings.Contains(err.Error(), "RC4 is not allowed in FIPS 140-only mode") {
    c, err = aes.NewCipher(keyAES32)
}
return c, err

Prevention

Replace all RC4 usage with AES or ChaCha20.
Scan dependencies for crypto/rc4 imports during FIPS migration.
Gate any legacy interop behind a non-FIPS build tag.

When it happens

Trigger: Calling rc4.NewCipher(key) in a binary built with FIPS 140-only enforcement. Importing a dependency that still uses RC4 (e.g., old TLS/legacy protocol code).

Common situations: Migrating a legacy application that uses RC4 for compatibility with old systems into a FIPS-only deployment. Third-party libraries with hardcoded RC4. Test code that exercises legacy cipher interop.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/f5d9ae4026049835. Report an issue: GitHub.