golang/go · error

crypto/rsa: generated key exponent too large

Error message

crypto/rsa: generated key exponent too large

What it means

Returned in the BoringCrypto branch of GenerateKey when the exponent E returned by boring.GenerateKeyRSA does not fit into an int (or its int64 cast loses bits). The BoringCrypto path is only taken when GOEXPERIMENT=boringcrypto is enabled and bits is 2048/3072/4096 with the default rand reader; in practice BoringCrypto returns E=65537, so this error indicates a BoringCrypto build/ABI mismatch or a corrupted BoringCrypto helper. It is not reachable on a normal (non-Boring) Go build.

Source

Thrown at src/crypto/rsa/rsa.go:339

	}

	if boring.Enabled && rand.IsDefaultReader(random) &&
		(bits == 2048 || bits == 3072 || bits == 4096) {
		bN, bE, bD, bP, bQ, bDp, bDq, bQinv, err := boring.GenerateKeyRSA(bits)
		if err != nil {
			return nil, err
		}
		N := bbig.Dec(bN)
		E := bbig.Dec(bE)
		D := bbig.Dec(bD)
		P := bbig.Dec(bP)
		Q := bbig.Dec(bQ)
		Dp := bbig.Dec(bDp)
		Dq := bbig.Dec(bDq)
		Qinv := bbig.Dec(bQinv)
		e64 := E.Int64()
		if !E.IsInt64() || int64(int(e64)) != e64 {
			return nil, errors.New("crypto/rsa: generated key exponent too large")
		}

		key := &PrivateKey{
			PublicKey: PublicKey{
				N: N,
				E: int(e64),
			},
			D:      D,
			Primes: []*big.Int{P, Q},
			Precomputed: PrecomputedValues{
				Dp:        Dp,
				Dq:        Dq,
				Qinv:      Qinv,
				CRTValues: make([]CRTValue, 0), // non-nil, to match Precompute
			},
		}
		return key, nil
	}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Retry rsa.GenerateKey once or twice — if transient, a new draw resolves it.
2. Rebuild with a stock Go toolchain (drop GOEXPERIMENT=boringcrypto) to bypass the BoringCrypto path; rsa.GenerateKey then uses the pure-Go generator.
3. If it reproduces, file a Go issue with your Go version, GOOS/GOARCH, and whether the toolchain is distro-provided.

Example fix

// no user-side code fix; this is a toolchain/BoringCrypto integrity issue.
// Workaround: build without boringcrypto.
//   go build -tags='' ...
// instead of GOEXPERIMENT=boringcrypto go build ...

When it happens

Trigger: Build with GOEXPERIMENT=boringcrypto (or distro BoringCrypto build) and call rsa.GenerateKey(rand.Reader, 2048) where the underlying BoringCrypto returns a malformed exponent; mixing an incompatible BoringCrypto shared object into the toolchain.

Common situations: Custom distro Go toolchain with a patched BoringCrypto; building with -tags=fips140 vs GOEXPERIMENT=boringcrypto inconsistently; rare and almost always indicates a toolchain issue rather than user code.

Related errors

• crypto/rsa: unsupported hash function
• crypto/rsa: invalid PSS salt length
• crypto/rsa: unsupported hash function: %d
• rsa: key too small
• crypto/rsa: p is even

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/4647d9eed24513a6. Report an issue: GitHub.