crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mo

Error message

crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode

What it means

Thrown by sha1.digest.Write when fips140only.Enforced() is true. In FIPS 140-only mode (GOFIPS=1 or equivalent), SHA-1 is not an approved algorithm for new hashing, so Write refuses to ingest data. The error appears at Write time, not at digest construction.

Source

Thrown at src/crypto/sha1/sha1.go:130

// also implements [encoding.BinaryMarshaler], [encoding.BinaryAppender] and
// [encoding.BinaryUnmarshaler] to marshal and unmarshal the internal
// state of the hash.
func New() hash.Hash {
	if boring.Enabled {
		return boring.NewSHA1()
	}
	d := new(digest)
	d.Reset()
	return d
}

func (d *digest) Size() int { return Size }

func (d *digest) BlockSize() int { return BlockSize }

func (d *digest) Write(p []byte) (nn int, err error) {
	if fips140only.Enforced() {
		return 0, errors.New("crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode")
	}
	boring.Unreachable()
	nn = len(p)
	d.len += uint64(nn)
	if d.nx > 0 {
		n := copy(d.x[d.nx:], p)
		d.nx += n
		if d.nx == chunk {
			block(d, d.x[:])
			d.nx = 0
		}
		p = p[n:]
	}
	if len(p) >= chunk {
		n := len(p) &^ (chunk - 1)
		block(d, p[:n])
		p = p[n:]
	}

View on GitHub (pinned to b6b368adc5)

Solutions

Switch the calling code to SHA-256 (crypto/sha256) or another FIPS-approved hash.
If SHA-1 is unavoidable and approved for your context, run without FIPS-only mode (do not set GOFIPS=1).
Audit HMAC/signature configuration to ensure SHA-256/384/512 are selected.
For TLS, disable TLS 1.0/1.1 and SHA-1 cipher suites on both client and server.

Example fix

// before
import "crypto/sha1"
h := sha1.New()
h.Write(data) // fails under GOFIPS=1
sum := h.Sum(nil)

// after
import "crypto/sha256"
h := sha256.New()
h.Write(data)
sum := h.Sum(nil)

Defensive patterns

Strategy: fallback

Validate before calling

// Detect FIPS-only mode at startup and select an approved hash.
func pickHash() crypto.Hash {
    if fips140only.Enforced() {
        return crypto.SHA256 // SHA-1 not allowed
    }
    return crypto.SHA1 // legacy path, if required
}

// Then use h := pickHash().New() instead of sha1.New() unconditionally.

Try / catch

// Wrap SHA-1 writes so a FIPS rejection is observable and recoverable.
func writeHash(h hash.Hash, data []byte) error {
    if _, err := h.Write(data); err != nil {
        if strings.Contains(err.Error(), "FIPS 140-only mode") {
            // switch to SHA-256 and retry
            h2 := sha256.New()
            h2.Write(data)
            return nil
        }
        return err
    }
    return nil
}

Prevention

Default to SHA-256 everywhere to be FIPS-safe.
Run CI with GOFIPS=1 to surface SHA-1 usage before deployment.
Audit TLS/X.509/HMAC configs to ensure SHA-1 is not selected.
Document any place SHA-1 is intentionally retained and flag it during FIPS rollout.

When it happens

Trigger: Calling Write on a sha1 (or crypto/sha1-backed) hash while the process runs in FIPS-only mode. Triggered by TLS/X.509/JWT code paths that select SHA-1, or direct sha1.Sum/Write usage under GOFIPS=1.

Common situations: Enabling GOFIPS=1 (or building with GOEXPERIMENT=boringcrypto FIPS) on a system that still has SHA-1 dependencies; legacy protocols (old TLS 1.0/1.1, HMAC-SHA1 in some APIs) selected by config; migration to FIPS mode exposing a leftover SHA-1 caller.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/93779d9f9c6b131c. Report an issue: GitHub.