{"record":{"id":"970c664d43493f79","repo":"gchq/CyberChef","slug":"the-key-must-be-exactly-32-bytes-long","errorCode":null,"errorMessage":"The key must be exactly 32 bytes long","messagePattern":"The key must be exactly 32 bytes long","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/BLAKE3.mjs","lineNumber":59,"sourceCode":"                \"value\": \"\"\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = args[1];\n        const size = args[0];\n        const opts = { dkLen: size };\n        const inputBytes = new Uint8Array(Utils.strToArrayBuffer(input));\n        if (key !== \"\") {\n            const keyBytes = new Uint8Array(Utils.strToArrayBuffer(key));\n            if (keyBytes.length !== 32) {\n                throw new OperationError(\"The key must be exactly 32 bytes long\");\n            }\n            opts.key = keyBytes;\n        }\n        return bytesToHex(blake3(inputBytes, opts));\n    }\n\n}\n\nexport default BLAKE3;\n","sourceCodeStart":41,"sourceCodeEnd":69,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/BLAKE3.mjs#L41-L69","documentation":"Thrown by BLAKE3.run when a non-empty key is supplied whose decoded length is not exactly 32 bytes. Unlike BLAKE2b/2s which accept a range of key sizes up to a maximum, BLAKE3's keyed mode requires a fixed 32-byte (256-bit) key; any other non-empty length is rejected. An empty key string is allowed and triggers unkeyed hashing.","triggerScenarios":"Supplying a key of any length other than 32 bytes: a 16-byte key, a long passphrase, or a hex/base64 value decoding to != 32 bytes.","commonSituations":"Reusing a 16-byte AES key or a 64-byte BLAKE2b key as the BLAKE3 key; pasting a passphrase expecting padding; hex miscount.","solutions":["Provide exactly 32 bytes of key material (64 hex chars), or leave the key empty for unkeyed hashing.","Derive a 32-byte key from a passphrase using a KDF before BLAKE3.","Confirm the key input option matches the encoding."],"exampleFix":"// before - 16-byte key\nchef.blake3(input, { key: \"00112233445566778899aabbccddeeff\", keyOption: \"Hex\" });\n\n// after - exactly 32 bytes\nchef.blake3(input, { key: \"00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff\", keyOption: \"Hex\" });","handlingStrategy":"validation","validationCode":"function assertBlake3Key(keyStr, keyOption) {\n  if (keyStr === \"\" || keyStr == null) return null;\n  const bytes = Utils.convertToByteArray(keyStr, keyOption);\n  if (bytes.length !== 32) throw new Error(`BLAKE3 key must be exactly 32 bytes, got ${bytes.length}`);\n  return bytes;\n}\nassertBlake3Key(key, keyOption);","typeGuard":"function isExactly32ByteHex(s) { return /^[0-9a-f]{64}$/i.test(s); }","tryCatchPattern":null,"preventionTips":["Use exactly 32 bytes (64 hex chars), or leave empty for unkeyed hashing.","Derive keys from passphrases with a KDF to hit exactly 32 bytes.","Note BLAKE3 needs a fixed (not maximum) key size."],"tags":["crypto","hash","blake3","key-length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}