{"record":{"id":"6538b77254c79a29","repo":"gchq/CyberChef","slug":"key-cannot-be-greater-than-64-bytes-it-is-currentl","errorCode":null,"errorMessage":"Key cannot be greater than 64 bytes\nIt is currently \" + key.length + \" bytes.","messagePattern":"Key cannot be greater than 64 bytes\nIt is currently \" \\+ key\\.length \\+ \" bytes\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/BLAKE2b.mjs","lineNumber":61,"sourceCode":"                \"type\": \"toggleString\",\n                \"value\": \"\",\n                \"toggleValues\": [\"UTF8\", \"Decimal\", \"Base64\", \"Hex\", \"Latin1\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {ArrayBuffer} input\n     * @param {Object[]} args\n     * @returns {string} The input having been hashed with BLAKE2b in the encoding format specified.\n     */\n    run(input, args) {\n        const [outSize, outFormat] = args;\n        let key = Utils.convertToByteArray(args[2].string || \"\", args[2].option);\n        if (key.length === 0) {\n            key = null;\n        } else if (key.length > 64) {\n            throw new OperationError([\"Key cannot be greater than 64 bytes\", \"It is currently \" + key.length + \" bytes.\"].join(\"\\n\"));\n        }\n\n        input = new Uint8Array(input);\n        switch (outFormat) {\n            case \"Hex\":\n                return blakejs.blake2bHex(input, key, outSize / 8);\n            case \"Base64\":\n                return toBase64(blakejs.blake2b(input, key, outSize / 8));\n            case \"Raw\":\n                return Utils.arrayBufferToStr(blakejs.blake2b(input, key, outSize / 8).buffer);\n            default:\n                return new OperationError(\"Unsupported Output Type\");\n        }\n    }\n\n}\n\nexport default BLAKE2b;","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/BLAKE2b.mjs#L43-L79","documentation":"Thrown by BLAKE2b.run when the optional key exceeds 64 bytes. BLAKE2b accepts a keyed-digest mode with a maximum key of 64 bytes (block size); longer keys are rejected rather than hashed down, because BLAKE2b's key schedule has fixed capacity for 64 key bytes. The key is decoded via Utils.convertToByteArray using the chosen input option, and an empty key is allowed (treated as unkeyed hashing).","triggerScenarios":"Supplying a key longer than 64 decoded bytes: a long UTF-8 passphrase, a >128-hex-char string, or base64 decoding to >64 bytes.","commonSituations":"Using a long passphrase as the key; reusing a 512-bit (64-byte) key plus extra; hex miscount producing 65+ bytes.","solutions":["Trim or hash the key material down to at most 64 bytes before passing it.","If you need to derive a key from a passphrase, use a KDF to produce a <=64-byte key.","Confirm the input option matches the encoding so the decoded length is what you expect."],"exampleFix":"// before - passphrase longer than 64 bytes\nchef.blake2b(input, { key: longPassphrase, keyOption: \"UTF8\" });\n\n// after - pre-hash to 64 bytes\nchef.blake2b(input, { key: sha512(longPassphrase), keyOption: \"Hex\" }); // 64 bytes","handlingStrategy":"validation","validationCode":"import Utils from \"src/core/Utils.mjs\";\nfunction assertBlake2bKey(keyStr, keyOption) {\n  if (!keyStr) return null;\n  const bytes = Utils.convertToByteArray(keyStr, keyOption);\n  if (bytes.length > 64) throw new Error(`BLAKE2b key max 64 bytes, got ${bytes.length}`);\n  return bytes;\n}\nassertBlake2bKey(key, keyOption);","typeGuard":"function isAtMostNBytes(s, option, n) {\n  if (option === \"Hex\") return /^[0-9a-f]{0,2*n}$/i.test(s);\n  return false;\n}","tryCatchPattern":null,"preventionTips":["Keep the BLAKE2b key <= 64 bytes; hash long passphrases first.","Leave the key empty for unkeyed hashing.","Match the input option to the key encoding."],"tags":["crypto","hash","blake2","key-length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}