golang/go · error

crypto/rsa: use of keys with odd size is not allowed in FIPS

Error message

crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode

What it means

Returned by GenerateKey when FIPS 140-only mode is active and bits is odd (bits%2 == 1). The standard mandates that the two primes each have equal bit length, which requires an even modulus bit length; an odd bits value cannot be split symmetrically, so FIPS-only mode rejects it. This check sits immediately after the 2048-bit floor and applies only when fips140only.Enforced() is true.

Source

Thrown at src/crypto/rsa/rsa.go:365

			D:      D,
			Primes: []*big.Int{P, Q},
			Precomputed: PrecomputedValues{
				Dp:        Dp,
				Dq:        Dq,
				Qinv:      Qinv,
				CRTValues: make([]CRTValue, 0), // non-nil, to match Precompute
			},
		}
		return key, nil
	}

	random = rand.CustomReader(random)

	if fips140only.Enforced() && bits < 2048 {
		return nil, errors.New("crypto/rsa: use of keys smaller than 2048 bits is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && bits%2 == 1 {
		return nil, errors.New("crypto/rsa: use of keys with odd size is not allowed in FIPS 140-only mode")
	}
	if fips140only.Enforced() && !fips140only.ApprovedRandomReader(random) {
		return nil, errors.New("crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-only mode")
	}

	k, err := rsa.GenerateKey(random, bits)
	if bits < 256 && err != nil {
		// Toy-sized keys have a non-negligible chance of hitting two hard
		// failure cases: p == q and d <= 2^(nlen / 2).
		//
		// Since these are impossible to hit for real keys, we don't want to
		// make the production code path more complex and harder to think about
		// to handle them.
		//
		// Instead, just rerun the whole process a total of 8 times, which
		// brings the chance of failure for 32-bit keys down to the same as for
		// 256-bit keys.
		for i := 1; i < 8 && err != nil; i++ {

View on GitHub (pinned to b6b368adc5)

Solutions

1. Round down to the nearest even size that is also ≥2048 (2048, 3072, 4096).
2. Validate the configured size before calling GenerateKey: if bits%2 != 0 { return err }.
3. Prefer the standard sizes (2048/3072/4096) so the BoringCrypto fast path also applies.

Example fix

// before (under GODEBUG=fips140=only)
priv, err := rsa.GenerateKey(rand.Reader, 2049) // err: odd size

// after
if bits%2 != 0 { bits-- }
priv, err := rsa.GenerateKey(rand.Reader, bits)

if bits%2 != 0 {
    return errors.New("RSA key size must be even")
}
return rsa.GenerateKey(rand.Reader, bits)

When it happens

Trigger: Call rsa.GenerateKey(rand.Reader, 2049) or 3000 under GODEBUG=fips140=only; compute bits dynamically from a configuration value that is off-by-one.

Common situations: Off-by-one in a configuration field (e.g. policy that says 2048 ± 1); user-supplied key size from a CLI flag without validation.

Related errors

• crypto/rsa: use of keys smaller than 2048 bits is not allowe
• crypto/rsa: only crypto/rand.Reader is allowed in FIPS 140-o
• crypto/rsa: multi-prime RSA is not allowed in FIPS 140-only
• crypto/rsa: invalid PSS salt length
• crypto/rsa: use of primes of different sizes is not allowed

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/7eed8a5797f26e1d. Report an issue: GitHub.