golang/go · error
crypto/rsa: public key missing N
Error message
crypto/rsa: public key missing N
What it means
Thrown by checkFIPS140OnlyPublicKey when fips140only.Enforced() and pub.N == nil. The public key's modulus is not set, meaning the key struct is uninitialized (zero-value) or was incompletely parsed. This is the first key-validity gate in FIPS-only mode; it fires before size/exponent checks.
Source
Thrown at src/crypto/rsa/fips.go:441
return ErrDecryption
case rsa.ErrVerification:
return ErrVerification
case rsa.ErrMessageTooLong:
return ErrMessageTooLong
}
return err
}
func fipsError2[T any](x T, err error) (T, error) {
return x, fipsError(err)
}
func checkFIPS140OnlyPublicKey(pub *PublicKey) error {
if !fips140only.Enforced() {
return nil
}
if pub.N == nil {
return errors.New("crypto/rsa: public key missing N")
}
if pub.N.BitLen() < 2048 {
return errors.New("crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode")
}
if pub.N.BitLen()%2 == 1 {
return errors.New("crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode")
}
if pub.E <= 1<<16 {
return errors.New("crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode")
}
if pub.E&1 == 0 {
return errors.New("crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode")
}
return nil
}
func checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {
if !fips140only.Enforced() {View on GitHub (pinned to b6b368adc5)
Solutions
- Load the key via x509.ParsePKIXPublicKey / x509.ParsePKCS1PublicKey and check the returned error before use.
- Add a nil check: if pub.N == nil { return errors.New("key not loaded") } before any RSA call.
- Ensure the key-parsing code path always runs on startup and fails fast on malformed input.
Example fix
// before
var pub rsa.PublicKey // N is nil
ct, err := rsa.EncryptOAEP(h, rand.Reader, &pub, msg, nil)
// after
pubAny, err := x509.ParsePKIXPublicKey(keyDER)
if err != nil { return err }
pub := pubAny.(*rsa.PublicKey)
ct, err := rsa.EncryptOAEP(h, rand.Reader, pub, msg, nil) Defensive patterns
Strategy: validation
Validate before calling
if pub == nil || pub.N == nil {
return errors.New("public key is nil or missing modulus N")
}
// proceed with RSA operations Type guard
func publicKeyHasN(pub *rsa.PublicKey) bool {
return pub != nil && pub.N != nil
} Prevention
- Always check the error from x509.ParsePKIXPublicKey / ParsePKCS1PublicKey before using the key.
- Add a startup health check that validates all loaded keys have non-nil N.
- Never pass a zero-value rsa.PublicKey to crypto operations.
When it happens
Trigger: Passing a freshly-declared &rsa.PublicKey{} (N is nil) to any FIPS-guarded RSA op. Parsing a malformed or truncated key (e.g. x509.ParsePKIXPublicKey on corrupt bytes returning a partial struct). Using a key literal without setting N.
Common situations: Key-loading code that ignores a parse error and proceeds with a zero-value key. Conditional key initialization where a branch leaves N unset. Test fixtures with placeholder keys.
Related errors
- crypto/rsa: use of keys with odd size is not allowed in FIPS
- crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in
- crypto/rsa: use of even public exponent is not allowed in FI
- crypto/rsa: use of multi-prime keys is not allowed in FIPS 1
- crypto/rsa: use of primes of different sizes is not allowed
AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12).
Data as JSON: /api/errors/4cd97f8c021c6f37.
Report an issue: GitHub.