golang/go · error

input overflows the modulus size

Error message

input overflows the modulus size

What it means

Thrown by bigmod.(*Nat).SetOverflowingBytes when the most significant limb of the decoded x has more set bits than the most significant limb of m. Unlike SetBytes, SetOverflowingBytes tolerates values in [m, 2^ceil(log2(m)) - 1], but it still rejects inputs whose bit length exceeds the modulus's bit length.

Source

Thrown at src/crypto/internal/fips140/bigmod/nat.go:207

	}
	return x, nil
}

// SetOverflowingBytes assigns x = b, where b is a slice of big-endian bytes.
// SetOverflowingBytes returns an error if b has a longer bit length than m, but
// reduces overflowing values up to 2^⌈log2(m)⌉ - 1.
//
// The output will be resized to the size of m and overwritten.
func (x *Nat) SetOverflowingBytes(b []byte, m *Modulus) (*Nat, error) {
	x.resetFor(m)
	if err := x.setBytes(b); err != nil {
		return nil, err
	}
	// setBytes would have returned an error if the input overflowed the limb
	// size of the modulus, so now we only need to check if the most significant
	// limb of x has more bits than the most significant limb of the modulus.
	if bitLen(x.limbs[len(x.limbs)-1]) > bitLen(m.nat.limbs[len(m.nat.limbs)-1]) {
		return nil, errors.New("input overflows the modulus size")
	}
	x.maybeSubtractModulus(no, m)
	return x, nil
}

// bigEndianUint returns the contents of buf interpreted as a
// big-endian encoded uint value.
func bigEndianUint(buf []byte) uint {
	if _W == 64 {
		return uint(byteorder.BEUint64(buf))
	}
	return uint(byteorder.BEUint32(buf))
}

func (x *Nat) setBytes(b []byte) error {
	i, k := len(b), 0
	for k < len(x.limbs) && i >= _S {
		x.limbs[k] = bigEndianUint(b[i-_S : i])

View on GitHub (pinned to b6b368adc5)

Solutions

1. Truncate or reduce the input so its bit length does not exceed that of m before calling SetOverflowingBytes.
2. Check len(b) against m.Size(); a longer byte slice means the value's bit length definitely exceeds the modulus.
3. Confirm you are passing the correct modulus for the input's expected size.

Example fix

// before
v, err := bigmod.NewNat().SetOverflowingBytes(hashTooWide, c.N)

// after: ensure the input is truncated to the order size first
if len(hashTooWide) > c.N.Size() {
    hashTooWide = hashTooWide[len(hashTooWide)-c.N.Size():]
}
v, err := bigmod.NewNat().SetOverflowingBytes(hashTooWide, c.N)

// Reject inputs whose byte length exceeds the modulus before SetOverflowingBytes.
if len(b) > m.Size() {
    return fmt.Errorf("bit length exceeds modulus size")
}
return bigmod.NewNat().SetOverflowingBytes(b, m)

func fitsModulusBitLen(b []byte, m *bigmod.Modulus) bool {
    return len(b) <= m.Size()
}

v, err := bigmod.NewNat().SetOverflowingBytes(b, m)
if err != nil {
    // truncate to the low order-sized bytes if the high bytes are zero-padding
    if len(b) > m.Size() && allZero(b[:len(b)-m.Size()]) {
        b = b[len(b)-m.Size():]
        v, err = bigmod.NewNat().SetOverflowingBytes(b, m)
    }
    if err != nil { return err }
}

When it happens

Trigger: Calling SetOverflowingBytes(b, m) with b whose bit length is greater than that of m — i.e. the top limb carries a bit beyond the modulus's top limb.

Common situations: Passing a hash output or computed value that is wider than the curve order without prior truncation, or a byte slice longer than the modulus representation that survives setBytes.

Related errors

• input overflows the modulus
• crypto/ecdh: invalid private key
• ecdsa: hash cannot be empty
• crypto/des: use of DES is not allowed in FIPS 140-only mode
• crypto/des: use of TripleDES is not allowed in FIPS 140-only

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/e933a00961e6503c. Report an issue: GitHub.