{"record":{"id":"9e00199e479f1436","repo":"peass-ng/PEASS-ng","slug":"salt-length-must-be-exactly-16-bytes","errorCode":null,"errorMessage":"salt length must be exactly 16 bytes","messagePattern":"salt length must be exactly 16 bytes","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2bDigest.cs","lineNumber":197,"sourceCode":"         * can be overwritten using the clearSalt() method.\n         *\n         * @param key             A key up to 64 bytes or null\n         * @param digestLength    from 1 up to 64 bytes\n         * @param salt            16 bytes or null\n         * @param personalization 16 bytes or null\n         */\n        public Blake2bDigest(byte[] key, int digestLength, byte[] salt, byte[] personalization)\n        {\n            if (digestLength < 1 || digestLength > 64)\n                throw new ArgumentException(\"Invalid digest length (required: 1 - 64)\");\n\n            this.digestLength = digestLength;\n            this.buffer = new byte[BLOCK_LENGTH_BYTES];\n\n            if (salt != null)\n            {\n                if (salt.Length != 16)\n                    throw new ArgumentException(\"salt length must be exactly 16 bytes\");\n\n                this.salt = new byte[16];\n                Array.Copy(salt, 0, this.salt, 0, salt.Length);\n            }\n            if (personalization != null)\n            {\n                if (personalization.Length != 16)\n                    throw new ArgumentException(\"personalization length must be exactly 16 bytes\");\n\n                this.personalization = new byte[16];\n                Array.Copy(personalization, 0, this.personalization, 0, personalization.Length);\n            }\n            if (key != null)\n            {\n                if (key.Length > 64)\n                    throw new ArgumentException(\"Keys > 64 are not supported\");\n\n                this.key = new byte[key.Length];","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2bDigest.cs#L179-L215","documentation":"The Blake2bDigest parameterized constructor throws ArgumentException when the digestLength parameter falls outside the 1-64 byte range allowed by BLAKE-2b; it fires in the constructor's validation guard before the salt check, so the faulting input is an out-of-range digestLength (not the salt, despite the salt wording in nearby docs).","triggerScenarios":"new Blake2bDigest(key, digestLength, salt, personalization) where salt != null and salt.Length != 16.","commonSituations":"Using 8- or 32-byte salts from other algorithms, passing an empty array instead of null when no salt is wanted, truncating/deriving salts incorrectly.","solutions":["Ensure the salt is exactly 16 bytes (zero-pad shorter salts, truncate longer ones)","Pass null instead of an empty or wrong-size array when salt is not used","Generate salts with a fixed 16-byte size"],"exampleFix":"// before\nvar d = new Blake2bDigest(key, 64, Encoding.UTF8.GetBytes(\"mysalt\"), null);\n// after\nbyte[] salt = new byte[16];\nArray.Copy(Encoding.UTF8.GetBytes(\"mysalt\"), salt, Math.Min(6, 16));\nvar d = new Blake2bDigest(key, 64, salt, null);","handlingStrategy":"validation","validationCode":"byte[] NormalizeSalt(byte[] salt) {\n    if (salt == null) return null;\n    if (salt.Length == 16) return salt;\n    var s = new byte[16];\n    Array.Copy(salt, s, Math.Min(salt.Length, 16));\n    return s;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Salts must be exactly 16 bytes or null","Pass null, not empty arrays, when salt is unused","Zero-pad shorter salts rather than truncating random salt data"],"tags":["csharp","bouncycastle","blake2b","salt-length"],"backgroundTag":"invalid-salt-length","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}