golang/go · error

crypto/rsa: use of keys smaller than 2048 bits is not allowe

Error message

crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode

What it means

Returned by GenerateKey when FIPS 140-only mode (GODEBUG=fips140=only) is active and the requested bits is below 2048. FIPS 140-3 SP 800-56Br2 disallows RSA keys under 2048 bits for new key generation, so the FIPS-only path rejects the request before calling the underlying generator. Note this fires before the general checkKeySize floor of 1024, so under FIPS-only mode even 1024/1536-bit requests fail here.

Source

Thrown at src/crypto/rsa/rsa.go:362

				N: N,
				E: int(e64),
			},
			D:      D,
			Primes: []*big.Int{P, Q},
			Precomputed: PrecomputedValues{
				Dp:        Dp,
				Dq:        Dq,
				Qinv:      Qinv,
				CRTValues: make([]CRTValue, 0), // non-nil, to match Precompute
			},
		}
		return key, nil
	}

	random = rand.CustomReader(random)

	if fips140only.Enforced() && bits < 2048 {
		return nil, errors.New("crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && bits%2 == 1 {
		return nil, errors.New("crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {
		return nil, errors.New("crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode")
	}

	k, err := rsa.GenerateKey(random, bits)
	if bits < 256 && err != nil {
		// Toy-sized keys have a non-negligible chance of hitting two hard
		// failure cases: p == q and d <= 2^(nlen / 2).
		//
		// Since these are impossible to hit for real keys, we don't want to
		// make the production code path more complex and harder to think about
		// to handle them.
		//
		// Instead, just rerun the whole process a total of 8 times, which

View on GitHub (pinned to b6b368adc5)

Solutions

1. Use 2048, 3072, or 4096 bits — these are also the sizes routed through BoringCrypto when available.
2. For tests, regenerate fixtures at 2048 bits or skip FIPS-only for unit tests that legitimately need toy keys.
3. If a peer mandates <2048-bit RSA, escalate — FIPS-only mode cannot comply.

Example fix

// before (under GODEBUG=fips140=only)
priv, err := rsa.GenerateKey(rand.Reader, 1024) // err: smaller than 2048

// after
priv, err := rsa.GenerateKey(rand.Reader, 2048)

const minBits = 2048
if bits < minBits {
    return fmt.Errorf("RSA key size %d below FIPS minimum %d", bits, minBits)
}
return rsa.GenerateKey(rand.Reader, bits)

When it happens

Trigger: Call rsa.GenerateKey(rand.Reader, 1024) (or any bits<2048) in a binary launched with GODEBUG=fips140=only; tests that historically used small keys now running in FIPS-only CI.

Common situations: Enabling FIPS-only compliance on a service that previously generated 1024-bit keys; test suite with t.Setenv("GODEBUG", "fips140=only") that still calls GenerateKey with small sizes.

Related errors

• crypto/rsa: use of keys with odd size is not allowed in FIPS
• crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-o
• crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only
• crypto/rsa: use of primes of different sizes is not allowed
• crypto/ecdsa: only crypto/rand.Reader is allowed in FIPS 140

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/e260e1145683181c. Report an issue: GitHub.