{"record":{"id":"a0666092ac23a346","repo":"peass-ng/PEASS-ng","slug":"keys-32-are-not-supported","errorCode":null,"errorMessage":"Keys > 32 are not supported","messagePattern":"Keys > 32 are not supported","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs","lineNumber":181,"sourceCode":"            Init();\n        }\n\n        /**\n         * BLAKE2s for authentication (\"Prefix-MAC mode\").\n         * <p/>\n         * After calling the doFinal() method, the key will remain to be used for\n         * further computations of this instance. The key can be overwritten using\n         * the clearKey() method.\n         *\n         * @param key a key up to 32 bytes or null\n         */\n        public Blake2sDigest(byte[] key)\n        {\n            buffer = new byte[BLOCK_LENGTH_BYTES];\n            if (key != null)\n            {\n                if (key.Length > 32)\n                    throw new ArgumentException(\"Keys > 32 are not supported\");\n\n                this.key = new byte[key.Length];\n                Array.Copy(key, 0, this.key, 0, key.Length);\n\n                keyLength = key.Length;\n                Array.Copy(key, 0, buffer, 0, key.Length);\n                bufferPos = BLOCK_LENGTH_BYTES; // zero padding\n            }\n            digestLength = 32;\n            Init();\n        }\n\n        /**\n         * BLAKE2s with key, required digest length, salt and personalization.\n         * <p/>\n         * After calling the doFinal() method, the key, the salt and the personal\n         * string will remain and might be used for further computations with this\n         * instance. The key can be overwritten using the clearKey() method, the","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs#L163-L199","documentation":"Blake2s is a 256-bit hash whose keyed mode (MAC-style) accepts keys of at most 32 bytes. The Blake2sDigest(byte[] key) constructor validates the key length and throws ArgumentException when it exceeds 32 bytes, because the key is copied into the 64-byte internal buffer and the Blake2s parameter block simply cannot encode a longer key.","triggerScenarios":"Calling new Blake2sDigest(byte[] key) with a key array whose Length > 32 (e.g. a 64-byte HMAC key, an RSA/PEM-derived key blob, or raw user-supplied secret bytes).","commonSituations":"Developers reuse a long symmetric key or an entire key file (PEM/DER bytes) as the Blake2s key instead of hashing/deriving a 32-byte subkey; porting code from Blake2b (which allows 64-byte keys) to Blake2s; concatenating salt+secret into one key buffer.","solutions":["Truncate or derive the key to at most 32 bytes before passing it: use a KDF (e.g. HKDF/PBKDF2) with a 32-byte output, or take key.AsSpan(0, 32).ToArray().","If a longer key must be supported, switch to Blake2bDigest, whose keyed mode accepts up to 64 bytes.","If the byte array is not meant to be a key, pass null or use the keyless constructor and feed the data via BlockUpdate()."],"exampleFix":"// before\nbyte[] longKey = File.ReadAllBytes(\"secret.pem\"); // > 32 bytes\nvar digest = new Blake2sDigest(longKey);\n// after\nbyte[] key32 = new byte[32];\nArray.Copy(longKey, key32, 32); // or derive via HKDF\nvar digest = new Blake2sDigest(key32);","handlingStrategy":"validation","validationCode":"if (key == null || key.Length > 32)\n    throw new ArgumentOutOfRangeException(nameof(key), \"Blake2s keys must be 1-32 bytes\");\nvar digest = new Blake2sDigest(key);","typeGuard":"static bool IsValidBlake2sKey(byte[] key) => key != null && key.Length <= 32;","tryCatchPattern":"try { var d = new Blake2sDigest(key); }\ncatch (ArgumentException ex) { /* fall back to keyless hash or derived 32-byte key */ }","preventionTips":["Derive keys with a KDF outputting exactly 32 bytes","Never pass PEM/DER blobs directly as digest keys","Prefer Blake2bDigest when >32-byte keys are required"],"tags":["csharp","cryptography","argument-validation","blake2s"],"backgroundTag":"invalid-key-length","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}