golang/go · error

crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-o

Error message

crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode

What it means

Returned by GenerateKey when FIPS 140-only mode is active and the random reader passed in is not the approved default (crypto/rand.Reader). The check uses fips140only.ApprovedRandomReader, which is satisfied only by the standard reader (or nil in callers that default to it). FIPS 140-3 requires an SP 800-90A-compliant DRBG, so a user-supplied reader is disallowed in FIPS-only mode. Note the call first does rand.CustomReader(random), so wrapping the default reader in a custom type may also fail this check.

Source

Thrown at src/crypto/rsa/rsa.go:368

				Dp:        Dp,
				Dq:        Dq,
				Qinv:      Qinv,
				CRTValues: make([]CRTValue, 0), // non-nil, to match Precompute
			},
		}
		return key, nil
	}

	random = rand.CustomReader(random)

	if fips140only.Enforced() && bits < 2048 {
		return nil, errors.New("crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && bits%2 == 1 {
		return nil, errors.New("crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {
		return nil, errors.New("crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode")
	}

	k, err := rsa.GenerateKey(random, bits)
	if bits < 256 && err != nil {
		// Toy-sized keys have a non-negligible chance of hitting two hard
		// failure cases: p == q and d <= 2^(nlen / 2).
		//
		// Since these are impossible to hit for real keys, we don't want to
		// make the production code path more complex and harder to think about
		// to handle them.
		//
		// Instead, just rerun the whole process a total of 8 times, which
		// brings the chance of failure for 32-bit keys down to the same as for
		// 256-bit keys.
		for i := 1; i < 8 && err != nil; i++ {
			k, err = rsa.GenerateKey(random, bits)
		}
	}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Pass rand.Reader (or nil-equivalent) directly so ApprovedRandomReader returns true.
2. For tests, use testing/cryptotest.SetGlobalRandom instead of substituting the reader argument, or set GODEBUG=cryptocustomrand=1 only in the test binary (and drop FIPS-only for those tests).
3. If you need a non-default entropy source for production, escalate — FIPS-only mode forbids it by design.

Example fix

// before (under GODEBUG=fips140=only)
priv, err := rsa.GenerateKey(myCustomReader, 2048) // err: only crypto/rand.Reader is allowed

// after
priv, err := rsa.GenerateKey(rand.Reader, 2048)

if !fips140only.ApprovedRandomReader(random) {
    // outside the fips140only package, fall back to crypto/rand.Reader
    random = rand.Reader
}
return rsa.GenerateKey(random, bits)

When it happens

Trigger: Call rsa.GenerateKey(myReader, 2048) where myReader is a deterministic or test reader, under GODEBUG=fips140=only; pass a custom reader to introduce entropy from a different source; tests that inject a seeded reader without disabling FIPS-only.

Common situations: Reproducible-crypto tests under FIPS-only CI; integrating an HSM/RNG whose output is funneled through an io.Reader; legacy code that wrapped rand.Reader for logging.

Related errors

• crypto/rsa: use of keys smaller than 2048 bits is not allowe
• crypto/rsa: use of keys with odd size is not allowed in FIPS
• crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only
• crypto/ecdsa: only crypto/rand.Reader is allowed in FIPS 140
• crypto/rsa: use of primes of different sizes is not allowed

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/5b74125874297b9f. Report an issue: GitHub.