What causes "rsa: key too small" in golang/go?

Use a minimum of 2048 bits for production keys (3072 or 4096 recommended for new deployments)

rsa: key too small

Error message

rsa: key too small

What it means

RSA key generation via GenerateKey requires at least 32 bits. This is the absolute floor below which the prime generation and modular arithmetic become meaningless. Note that 32 bits is far below any security standard — keys under 2048 bits are recorded as non-approved for FIPS purposes but are still generated (the function only hard-rejects below 32).

Source

Thrown at src/crypto/internal/fips140/rsa/keygen.go:26

	"crypto/internal/fips140"
	"crypto/internal/fips140/bigmod"
	"crypto/internal/fips140/drbg"
	"errors"
	"io"
)

// GenerateKey generates a new RSA key pair of the given bit size.
// bits must be at least 32.
//
// It follows the process described at c2sp.org/det-keygen, which is compliant
// with FIPS 186-5, Appendix A.1, IFC Key Pair Generation and FIPS 186-5,
// Appendix A.1.3, Generation of Random Primes that are Probably Prime.
// The prime candidates are drawn from rand, which in production will be the
// global DRBG, while in tests can be an HMAC_DRBG as specified in
// c2sp.org/det-keygen, to allow using its tests vectors.
func GenerateKey(rand io.Reader, bits int) (*PrivateKey, error) {
	if bits < 32 {
		return nil, errors.New("rsa: key too small")
	}
	fips140.RecordApproved()
	if bits < 2048 || bits%2 == 1 {
		fips140.RecordNonApproved()
	}

	for {
		p, err := randomPrime(rand, (bits+1)/2)
		if err != nil {
			return nil, err
		}
		q, err := randomPrime(rand, bits/2)
		if err != nil {
			return nil, err
		}

		P, err := bigmod.NewModulus(p)
		if err != nil {

View on GitHub (pinned to b6b368adc5)

Solutions

Use a minimum of 2048 bits for production keys (3072 or 4096 recommended for new deployments)
Validate bits >= 2048 (or your security policy minimum) before calling GenerateKey
For tests, use at least 32 bits (128 or 256 recommended for speed while staying valid)

Example fix

// before
key, err := rsa.GenerateKey(rand, bits)

// after
if bits < 2048 {
    return nil, fmt.Errorf("RSA key size must be at least 2048 bits, got %d", bits)
}
key, err := rsa.GenerateKey(rand, bits)

Defensive patterns

Strategy: validation

Validate before calling

func validateRSAKeySize(bits int) error {
    if bits < 2048 {
        return fmt.Errorf("RSA key size must be at least 2048 bits, got %d", bits)
    }
    if bits%2 == 1 {
        return fmt.Errorf("RSA key size must be even, got %d", bits)
    }
    return nil
}

if err := validateRSAKeySize(bits); err != nil { return err }
key, err := rsa.GenerateKey(rand, bits)

Try / catch

key, err := rsa.GenerateKey(rand, bits)
if err != nil {
    return fmt.Errorf("RSA key generation failed: %w", err)
}

Prevention

Enforce a minimum of 2048 bits at the application layer (the library floor of 32 is not a security recommendation)
Use 3072 or 4096 bits for new deployments per current NIST guidance
For tests, use at least 2048 bits or mock the RSA operations for speed

When it happens

Trigger: Calling rsa.GenerateKey(rand, bits) with bits < 32.

Common situations: bits read from a misconfigured constant or environment variable defaulting to a small value; a unit test using a deliberately small key for speed that accidentally goes below 32; arithmetic error computing the bit size (e.g., bytes vs bits confusion).

Related errors

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/9445940785306adc. Report an issue: GitHub.