{"record":{"id":"476685dbdf486d80","repo":"jstedfast/MailKit","slug":"invalid-nonce-length-should-be-8-bytes","errorCode":null,"errorMessage":"Invalid nonce length (should be 8 bytes).","messagePattern":"Invalid nonce length \\(should be 8 bytes\\)\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs","lineNumber":138,"sourceCode":"\n\t\t\tif (ExportedSessionKey != null)\n\t\t\t\tArray.Clear (ExportedSessionKey, 0, ExportedSessionKey.Length);\n\n\t\t\tif (EncryptedRandomSessionKey != null)\n\t\t\t\tArray.Clear (EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length);\n\t\t}\n\n\t\t/// <summary>\n\t\t/// This is only used for unit testing purposes.\n\t\t/// </summary>\n\t\tinternal byte[]? ClientChallenge {\n\t\t\tget { return clientChallenge; }\n\t\t\tset {\n\t\t\t\tif (value == null)\n\t\t\t\t\treturn;\n\n\t\t\t\tif (value.Length != 8)\n\t\t\t\t\tthrow new ArgumentException (\"Invalid nonce length (should be 8 bytes).\", nameof (value));\n\n\t\t\t\tArray.Clear (clientChallenge, 0, clientChallenge.Length);\n\t\t\t\tclientChallenge = value;\n\t\t\t}\n\t\t}\n\n\t\t/// <summary>\n\t\t/// This is only used for unit testing purposes.\n\t\t/// </summary>\n\t\tinternal long? Timestamp {\n\t\t\tget; set;\n\t\t}\n\n\t\tpublic string Domain {\n\t\t\tget; private set;\n\t\t}\n\n\t\tpublic string Workstation {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs#L120-L156","documentation":"Setting the ClientChallenge property throws ArgumentException \"Invalid nonce length (should be 8 bytes).\" when the supplied byte[] is not exactly 8 bytes long. The NTLM client nonce is a fixed 64-bit value.","triggerScenarios":"Assigning ClientChallenge = someBytes where someBytes.Length != 8 — e.g. a 16-byte random buffer, or a hex/FromBase64-decoded value of unexpected length.","commonSituations":"Generating a nonce with the wrong size (RandomNumberGenerator.GetBytes(16)); hand-crafted NTLMv2 tests; truncating/padding mistakes.","solutions":["Pass exactly 8 bytes (e.g. RandomNumberGenerator.GetBytes(8) or NtlmUtils.NONCE(8)).","Check value.Length == 8 before assigning.","Note that assigning null is silently ignored by this setter; only wrong-length non-null arrays throw."],"exampleFix":"// before\nauth.ClientChallenge = RandomNumberGenerator.GetBytes(16); // 16 bytes\n// after\nauth.ClientChallenge = RandomNumberGenerator.GetBytes(8); // exactly 8 bytes","handlingStrategy":"validation","validationCode":"if (clientChallenge is { Length: not 8 }) throw new ArgumentException(\"ClientChallenge must be exactly 8 bytes.\");\nauth.ClientChallenge = clientChallenge;","typeGuard":"static bool IsValidNonce(byte[]? nonce) => nonce == null || nonce.Length == 8;","tryCatchPattern":"try {\n\tauth.ClientChallenge = nonce;\n} catch (ArgumentException ex) when (ex.Message.Contains(\"nonce length\")) {\n\t// regenerate a correct-size nonce\n\tauth.ClientChallenge = NtlmUtils.NONCE(8);\n}","preventionTips":["Generate nonces with NtlmUtils.NONCE(8) or RandomNumberGenerator.GetBytes(8).","Remember the setter treats null as a no-op; only wrong lengths throw.","Add a length assert when generating nonces in test fixtures."],"tags":["invalid-argument-value","csharp","ntlm","nonce"],"backgroundTag":"invalid-argument-value","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}