golang/go · error
crypto/rsa: use of keys smaller than 2048 bits is not allowe
Error message
crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode
What it means
Thrown by checkFIPS140OnlyPublicKey when fips140only.Enforced() and pub.N.BitLen() < 2048. FIPS 140-3 / SP 800-56Br2 mandates RSA moduli of at least 2048 bits for key establishment and signing. 1024-bit keys (and smaller) that worked in non-FIPS builds are rejected.
Source
Thrown at src/crypto/rsa/fips.go:444
case rsa.ErrMessageTooLong:
return ErrMessageTooLong
}
return err
}
func fipsError2[T any](x T, err error) (T, error) {
return x, fipsError(err)
}
func checkFIPS140OnlyPublicKey(pub *PublicKey) error {
if !fips140only.Enforced() {
return nil
}
if pub.N == nil {
return errors.New("crypto/rsa: public key missing N")
}
if pub.N.BitLen() < 2048 {
return errors.New("crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode")
}
if pub.N.BitLen()%2 == 1 {
return errors.New("crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode")
}
if pub.E <= 1<<16 {
return errors.New("crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode")
}
if pub.E&1 == 0 {
return errors.New("crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode")
}
return nil
}
func checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {
if !fips140only.Enforced() {
return nil
}
if err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {View on GitHub (pinned to b6b368adc5)
Solutions
- Generate a new 2048-bit (or larger, e.g. 3072) key: rsa.GenerateKey(rand.Reader, 2048).
- Re-issue certificates and re-sign artifacts with the new key; rotate peers onto it.
- If a 1024-bit key is unavoidable, that operation must run outside FIPS-only mode.
Example fix
// before priv, _ := rsa.GenerateKey(rand.Reader, 1024) sig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts) // after priv, _ := rsa.GenerateKey(rand.Reader, 2048) sig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)
Defensive patterns
Strategy: validation
Validate before calling
if pub.N.BitLen() < 2048 {
return fmt.Errorf("RSA key is %d bits; FIPS requires >= 2048", pub.N.BitLen())
}
// proceed Type guard
func keyMeetsFIPSSize(pub *rsa.PublicKey) bool {
return pub != nil && pub.N != nil && pub.N.BitLen() >= 2048
} Prevention
- Generate all new RSA keys at 2048 bits minimum (3072 recommended for long-term).
- Audit existing keys/certs for < 2048-bit moduli before switching to FIPS-only.
- Reject sub-2048 keys at the key-loading layer.
When it happens
Trigger: Using a 1024-bit RSA key (BitLen()==1024) in any SignPSS/VerifyPSS/SignPKCS1v15/VerifyPKCS1v15/EncryptOAEP/DecryptOAEP call under FIPS-only enforcement. Loading an old certificate's key that predates the 2048-bit baseline.
Common situations: Legacy infrastructure with 1024-bit root/intermediate keys. Embedded/device certs generated under old key-size norms. Cost-optimized key generation that picked 1024 bits historically.
Related errors
- crypto/rsa: unsupported hash function
- crypto/rsa: invalid PSS salt length
- crypto/rsa: use of PSS salt longer than the hash is not allo
- crypto/rsa: public key missing N
- crypto/rsa: use of keys with odd size is not allowed in FIPS
AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12).
Data as JSON: /api/errors/3e07be46517553cc.
Report an issue: GitHub.