crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-o

Error message

crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode

What it means

Returned during RSA PSS signing in FIPS 140-only mode when the random reader passed in is not crypto/rand.Reader. FIPS-approved signing must draw randomness exclusively from the approved RNG; custom or alternative readers are rejected via fips140only.ApprovedRandomReader. This ensures the non-deterministic PSS salt comes from a validated entropy source.

Source

Thrown at src/crypto/rsa/fips.go:97

		return boring.SignRSAPSS(bkey, hash, digest, opts.saltLength())
	}
	if priv.N.BitLen() >= 1024 {
		boring.UnreachableExceptTests()
	}

	if !hash.Available() {
		return nil, errors.New("crypto/rsa: requested hash function unavailable: " + hash.String())
	}
	h := fips140hash.Unwrap(hash.New())

	if err := checkFIPS140OnlyPrivateKey(priv); err != nil {
		return nil, err
	}
	if fips140only.Enforced() && !fips140only.ApprovedHash(h) {
		return nil, errors.New("crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {
		return nil, errors.New("crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode")
	}

	k, err := fipsPrivateKey(priv)
	if err != nil {
		return nil, err
	}

	saltLength := opts.saltLength()
	if fips140only.Enforced() && saltLength > h.Size() {
		return nil, errors.New("crypto/rsa: use of PSS salt longer than the hash is not allowed in FIPS 140-only mode")
	}
	switch saltLength {
	case PSSSaltLengthAuto:
		saltLength, err = rsa.PSSMaxSaltLength(k.PublicKey(), h)
		if err != nil {
			return nil, fipsError(err)
		}
	case PSSSaltLengthEqualsHash:

View on GitHub (pinned to b6b368adc5)

Solutions

Always pass crypto/rand.Reader to rsa.SignPSS in FIPS builds.
For deterministic test signatures, run tests outside FIPS-only mode or use a non-FIPS test binary.
Audit any reader parameter forwarding to ensure only rand.Reader reaches the signer.

Example fix

// before (FIPS-only build)
sig, err := rsa.SignSS(mockReader, priv, crypto.SHA256, digest, opts) // error

// after
sig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)

Defensive patterns

Strategy: validation

Validate before calling

if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {
    random = crypto/rand.Reader
}
return rsa.SignPSS(random, priv, hash, digest, opts)

Type guard

func isApprovedReader(r io.Reader) bool {
    return fips140only.ApprovedRandomReader(r)
}

Try / catch

sig, err := rsa.SignPSS(random, priv, hash, digest, opts)
if err != nil && strings.Contains(err.Error(), "only crypto/rand.Reader is allowed") {
    sig, err = rsa.SignPSS(crypto/rand.Reader, priv, hash, digest, opts)
}
return sig, err

Prevention

Always pass crypto/rand.Reader to RSA signing in FIPS builds.
Reserve deterministic readers for non-FIPS test binaries.
Audit any function that accepts an io.Reader and forwards it to signing.

When it happens

Trigger: Passing a custom io.Reader (e.g., a deterministic test reader, a pooled buffer, hmac.Drbg) to rsa.SignPSS in a FIPS-only build. Forgetting to pass rand.Reader and passing nil or a mock.

Common situations: Test code that injects a deterministic reader for reproducible PSS signatures. Libraries that accept a reader parameter and forward caller-supplied readers. Performance code reusing a buffer-backed reader.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/52a18b4c5babd963. Report an issue: GitHub.