golang/go · error

crypto/rsa: GenerateMultiPrimeKey: nprimes must be >= 2

Error message

crypto/rsa: GenerateMultiPrimeKey: nprimes must be >= 2

What it means

Returned by GenerateMultiPrimeKey when nprimes < 2. The function explicitly redirects nprimes==2 to GenerateKey, so this error only fires for nprimes 0 or 1 — values that cannot form an RSA modulus. It is a programmer-error guard, not a security or compliance check (it fires even outside FIPS mode).

Source

Thrown at src/crypto/rsa/rsa.go:449

// two is not recommended for the above security, compatibility, and performance
// reasons. Use [GenerateKey] instead.
//
// [On the Security of Multi-prime RSA]: http://www.cacr.math.uwaterloo.ca/techreports/2006/cacr2006-16.pdf
func GenerateMultiPrimeKey(random io.Reader, nprimes int, bits int) (*PrivateKey, error) {
	if nprimes == 2 {
		return GenerateKey(random, bits)
	}
	if fips140only.Enforced() {
		return nil, errors.New("crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only mode")
	}

	random = rand.CustomReader(random)

	priv := new(PrivateKey)
	priv.E = 65537

	if nprimes < 2 {
		return nil, errors.New("crypto/rsa: GenerateMultiPrimeKey: nprimes must be >= 2")
	}

	if bits < 64 {
		primeLimit := float64(uint64(1) << uint(bits/nprimes))
		// pi approximates the number of primes less than primeLimit
		pi := primeLimit / (math.Log(primeLimit) - 1)
		// Generated primes start with 11 (in binary) so we can only
		// use a quarter of them.
		pi /= 4
		// Use a factor of two to ensure that key generation terminates
		// in a reasonable amount of time.
		pi /= 2
		if pi <= float64(nprimes) {
			return nil, errors.New("crypto/rsa: too few primes of given length to generate an RSA key")
		}
	}

	primes := make([]*big.Int, nprimes)

View on GitHub (pinned to b6b368adc5)

Solutions

1. Pass nprimes == 2 (which routes to GenerateKey) — there is no good reason to call GenerateMultiPrimeKey with any other value today.
2. Validate the caller's input: if nprimes < 2 { return ErrInvalidPrimeCount } before reaching GenerateMultiPrimeKey.
3. Prefer rsa.GenerateKey outright and drop GenerateMultiPrimeKey usage.

Example fix

// before
priv, err := rsa.GenerateMultiPrimeKey(rand.Reader, 1, 2048) // err: nprimes must be >= 2

// after
priv, err := rsa.GenerateKey(rand.Reader, 2048)

if nprimes < 2 {
    return errors.New("nprimes must be >= 2")
}
if nprimes == 2 {
    return rsa.GenerateKey(rand.Reader, bits)
}
return rsa.GenerateMultiPrimeKey(rand.Reader, nprimes, bits)

When it happens

Trigger: Call rsa.GenerateMultiPrimeKey(rand.Reader, 1, 2048) or GenerateMultiPrimeKey(rand.Reader, 0, 2048); compute nprimes from user input without a lower-bound check.

Common situations: Off-by-one when computing prime count from a configuration value; copy-paste from a tutorial that used nprimes=1 as a placeholder.

Related errors

• crypto/rsa: too few primes of given length to generate an RS
• crypto/rsa: use of keys with odd size is not allowed in FIPS
• crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only
• crypto/rsa: invalid PSS salt length
• rsa: key too small

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/dde8b6e96d558dea. Report an issue: GitHub.