{"record":{"id":"026c65a46d63ec74","repo":"gchq/CyberChef","slug":"key-cannot-be-greater-than-32-bytes-it-is-currentl","errorCode":null,"errorMessage":"Key cannot be greater than 32 bytes\nIt is currently \" + key.length + \" bytes.","messagePattern":"Key cannot be greater than 32 bytes\nIt is currently \" \\+ key\\.length \\+ \" bytes\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/BLAKE2s.mjs","lineNumber":62,"sourceCode":"                \"type\": \"toggleString\",\n                \"value\": \"\",\n                \"toggleValues\": [\"UTF8\", \"Decimal\", \"Base64\", \"Hex\", \"Latin1\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {ArrayBuffer} input\n     * @param {Object[]} args\n     * @returns {string} The input having been hashed with BLAKE2s in the encoding format specified.\n     */\n    run(input, args) {\n        const [outSize, outFormat] = args;\n        let key = Utils.convertToByteArray(args[2].string || \"\", args[2].option);\n        if (key.length === 0) {\n            key = null;\n        } else if (key.length > 32) {\n            throw new OperationError([\"Key cannot be greater than 32 bytes\", \"It is currently \" + key.length + \" bytes.\"].join(\"\\n\"));\n        }\n\n        input = new Uint8Array(input);\n        switch (outFormat) {\n            case \"Hex\":\n                return blakejs.blake2sHex(input, key, outSize / 8);\n            case \"Base64\":\n                return toBase64(blakejs.blake2s(input, key, outSize / 8));\n            case \"Raw\":\n                return Utils.arrayBufferToStr(blakejs.blake2s(input, key, outSize / 8).buffer);\n            default:\n                return new OperationError(\"Unsupported Output Type\");\n        }\n    }\n\n}\n\nexport default BLAKE2s;","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/BLAKE2s.mjs#L44-L80","documentation":"Thrown by BLAKE2s.run when the optional key exceeds 32 bytes. BLAKE2s (the 32-bit variant) accepts a keyed-digest mode with a maximum key of 32 bytes (its block size is 64 bytes but the key field is limited to 32); longer keys are rejected. The key is decoded via Utils.convertToByteArray and an empty key is allowed (unkeyed hashing).","triggerScenarios":"Supplying a key longer than 32 decoded bytes: a long passphrase, a >64-hex-char string, or base64 decoding to >32 bytes.","commonSituations":"Using a passphrase longer than 32 bytes; reusing a 256-bit key plus extra; confusing BLAKE2b (64-byte max) with BLAKE2s (32-byte max).","solutions":["Trim or hash the key material down to at most 32 bytes before passing it.","Use a KDF to derive a <=32-byte key from a passphrase.","If you need a longer key, switch to BLAKE2b (max 64 bytes)."],"exampleFix":"// before - 48-byte key\nchef.blake2s(input, { key: \"00...\" /* 96 hex chars */, keyOption: \"Hex\" });\n\n// after - 32-byte key (64 hex chars)\nchef.blake2s(input, { key: \"00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff\", keyOption: \"Hex\" });","handlingStrategy":"validation","validationCode":"import Utils from \"src/core/Utils.mjs\";\nfunction assertBlake2sKey(keyStr, keyOption) {\n  if (!keyStr) return null;\n  const bytes = Utils.convertToByteArray(keyStr, keyOption);\n  if (bytes.length > 32) throw new Error(`BLAKE2s key max 32 bytes, got ${bytes.length}`);\n  return bytes;\n}\nassertBlake2sKey(key, keyOption);","typeGuard":"function isAtMostNBytes(s, option, n) {\n  if (option === \"Hex\") return /^[0-9a-f]{0,2*n}$/i.test(s);\n  return false;\n}","tryCatchPattern":null,"preventionTips":["Keep the BLAKE2s key <= 32 bytes (not 64 like BLAKE2b).","Hash long passphrases down to <= 32 bytes first.","Leave the key empty for unkeyed hashing."],"tags":["crypto","hash","blake2","key-length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}