golang/go · error

FIPS 140-3 mode is incompatible with ASAN

Error message

FIPS 140-3 mode is incompatible with ASAN

What it means

Returned by fips140.Supported() when the build was compiled with the ASAN sanitizer (-asan). The FIPS module reads large swaths of global memory in its integrity check (fips140/check), and ASAN flags this as out-of-bounds reads, producing false positives. FIPS+ASAN is not supported.

Source

Thrown at src/crypto/internal/fips140/fips140.go:47

}

// Supported returns an error if FIPS 140-3 mode can't be enabled.
func Supported() error {
	// Keep this in sync with fipsSupported in cmd/dist/test.go.

	// The purego tag changes too much of the implementation to claim the
	// validation still applies.
	if puregoEnabled {
		return errors.New("FIPS 140-3 mode is incompatible with the purego build tag")
	}

	// ASAN disapproves of reading swaths of global memory in fips140/check.
	// One option would be to expose runtime.asanunpoison through
	// crypto/internal/fips140deps and then call it to unpoison the range
	// before reading it, but it is unclear whether that would then cause
	// false negatives. For now, FIPS+ASAN doesn't need to work.
	if asanEnabled {
		return errors.New("FIPS 140-3 mode is incompatible with ASAN")
	}

	// See EnableFIPS in cmd/internal/obj/fips.go for commentary.
	// Also, js/wasm and windows/386 don't have good enough timers
	// for the CPU jitter entropy source.
	switch {
	case runtime.GOARCH == "wasm",
		runtime.GOOS == "windows" && runtime.GOARCH == "386",
		runtime.GOOS == "openbsd", // due to -fexecute-only, see #70880
		runtime.GOOS == "aix":
		return errors.New("FIPS 140-3 mode is not supported on " + runtime.GOOS + "-" + runtime.GOARCH)
	}

	if boringEnabled {
		return errors.New("FIPS 140-3 mode is incompatible with GOEXPERIMENT=boringcrypto")
	}

	return nil

View on GitHub (pinned to b6b368adc5)

Solutions

  1. Disable ASAN for the FIPS build — FIPS and ASAN are mutually exclusive by design.
  2. Run ASAN and FIPS test configurations as separate CI jobs.
  3. If you need to debug a FIPS-only memory issue, use other tooling (manual inspection, MSAN on unrelated paths) rather than forcing FIPS+ASAN.

Example fix

# before
go build -asan -tags=fips140 ./...

# after
go build -tags=fips140 ./...
Defensive patterns

Strategy: validation

Validate before calling

if err := fips140.Supported(); err != nil {
    if strings.Contains(err.Error(), "ASAN") {
        log.Fatal("FIPS mode and ASAN are mutually exclusive; rebuild without -asan")
    }
    log.Fatalf("FIPS unsupported: %v", err)
}

Try / catch

if err := fips140.Supported(); err != nil {
    return fmt.Errorf("FIPS startup check failed: %w", err)
}

Prevention

When it happens

Trigger: Building with go build -asan (or GOEXPERIMENT=asan / equivalent) and then calling fips140.Supported() or enabling GOFIPS140=1.

Common situations: CI sanitizer jobs that enable ASAN globally; security-fuzzing harnesses; locally debugging memory issues with -asan and then attempting to also test FIPS mode.

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/103c76908a10e16e. Report an issue: GitHub.