golang/go · error
crypto/rsa: use of multi-prime keys is not allowed in FIPS 1
Error message
crypto/rsa: use of multi-prime keys is not allowed in FIPS 140-only mode
What it means
Thrown by checkFIPS140OnlyPrivateKey when fips140only.Enforced() and len(priv.Primes) != 2. Standard RSA uses exactly two primes; multi-prime RSA (3+ primes) is faster but explicitly disallowed by FIPS 140-only mode. This also catches the degenerate case of fewer than 2 primes (malformed key). The check runs after the public-key checks pass.
Source
Thrown at src/crypto/rsa/fips.go:466
}
if pub.E <= 1<<16 {
return errors.New("crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in FIPS 140-only mode")
}
if pub.E&1 == 0 {
return errors.New("crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode")
}
return nil
}
func checkFIPS140OnlyPrivateKey(priv *PrivateKey) error {
if !fips140only.Enforced() {
return nil
}
if err := checkFIPS140OnlyPublicKey(&priv.PublicKey); err != nil {
return err
}
if len(priv.Primes) != 2 {
return errors.New("crypto/rsa: use of multi-prime keys is not allowed in FIPS 140-only mode")
}
if priv.Primes[0] == nil || priv.Primes[1] == nil || priv.Primes[0].BitLen() != priv.Primes[1].BitLen() {
return errors.New("crypto/rsa: use of primes of different sizes is not allowed in FIPS 140-only mode")
}
return nil
}
View on GitHub (pinned to b6b368adc5)
Solutions
- Regenerate the key with rsa.GenerateKey(rand.Reader, 2048) which produces exactly 2 primes.
- Validate at load: if len(priv.Primes) != 2 { reject }.
- Avoid rsa.GenerateMultiPrimeKey entirely in FIPS-compliant code paths.
Example fix
// before priv, _ := rsa.GenerateMultiPrimeKey(rand.Reader, 3, 2048) sig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts) // after priv, _ := rsa.GenerateKey(rand.Reader, 2048) sig, err := rsa.SignPSS(rand.Reader, priv, crypto.SHA256, digest, opts)
Defensive patterns
Strategy: validation
Validate before calling
if len(priv.Primes) != 2 {
return fmt.Errorf("private key has %d primes; FIPS-only mode requires exactly 2", len(priv.Primes))
}
// proceed Type guard
func isTwoPrimeKey(priv *rsa.PrivateKey) bool {
return priv != nil && len(priv.Primes) == 2
} Prevention
- Never use rsa.GenerateMultiPrimeKey in FIPS-compliant code — always rsa.GenerateKey.
- Reject keys with != 2 primes at the load/parse layer.
- Audit imported keys (e.g. from PKCS#1 multi-prime format) for prime count.
When it happens
Trigger: Using a private key generated with rsa.GenerateMultiPrimeKey (3+ primes) in a FIPS-only build. Loading a key parsed from a multi-prime PKCS#1 structure. A malformed key with 0 or 1 primes.
Common situations: Performance-optimized multi-prime keys (common in some Java/old systems) migrated to a Go FIPS-only service. Test keys generated with GenerateMultiPrimeKey for speed.
Related errors
- crypto/rsa: public key missing N
- crypto/rsa: use of keys with odd size is not allowed in FIPS
- crypto/rsa: use of public exponent <= 2¹⁶ is not allowed in
- crypto/rsa: use of even public exponent is not allowed in FI
- crypto/rsa: use of primes of different sizes is not allowed
AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12).
Data as JSON: /api/errors/1f74777ee0535c9d.
Report an issue: GitHub.