{"record":{"id":"a38ba88406a59568","repo":"peass-ng/PEASS-ng","slug":"keys-32-bytes-are-not-supported","errorCode":null,"errorMessage":"Keys > 32 bytes are not supported","messagePattern":"Keys > 32 bytes are not supported","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs","lineNumber":235,"sourceCode":"            {\n                if (salt.Length != 8)\n                    throw new ArgumentException(\"Salt length must be exactly 8 bytes\");\n\n                this.salt = new byte[8];\n                Array.Copy(salt, 0, this.salt, 0, salt.Length);\n            }\n            if (personalization != null)\n            {\n                if (personalization.Length != 8)\n                    throw new ArgumentException(\"Personalization length must be exactly 8 bytes\");\n\n                this.personalization = new byte[8];\n                Array.Copy(personalization, 0, this.personalization, 0, personalization.Length);\n            }\n            if (key != null)\n            {\n                if (key.Length > 32)\n                    throw new ArgumentException(\"Keys > 32 bytes are not supported\");\n\n                this.key = new byte[key.Length];\n                Array.Copy(key, 0, this.key, 0, key.Length);\n\n                keyLength = key.Length;\n                Array.Copy(key, 0, buffer, 0, key.Length);\n                bufferPos = BLOCK_LENGTH_BYTES; // zero padding\n            }\n            Init();\n        }\n\n        // initialize chainValue\n        private void Init()\n        {\n            if (chainValue == null)\n            {\n                chainValue = new uint[8];\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs#L217-L253","documentation":"Same 32-byte key limit as the simple constructor, but raised by the full Blake2sDigest(key, digestBytes, salt, personalization) constructor after the salt/personalization checks. Blake2s keyed mode cannot hold more than 32 key bytes in its parameter block, so a longer key throws ArgumentException.","triggerScenarios":"new Blake2sDigest(key, digestBytes, salt, personalization) with key != null and key.Length > 32 — e.g. a 64-byte key that worked with Blake2b, or a derived key blob passed wholesale.","commonSituations":"Migrating keyed hashing from Blake2b (64-byte keys) to Blake2s (32-byte max); passing a full PEM/DER key file; supplying concatenations of key material.","solutions":["Derive or truncate the key to at most 32 bytes (HKDF/PBKDF2 with 32-byte output) before constructing the digest.","Use Blake2bDigest if keys longer than 32 bytes are required.","Pass null and use keyless hashing if the byte array is data rather than a key."],"exampleFix":"// before\nvar digest = new Blake2sDigest(sixtyFourByteKey, 32, salt, null);\n// after\nbyte[] key32 = new byte[32];\nArray.Copy(sixtyFourByteKey, key32, 32);\nvar digest = new Blake2sDigest(key32, 32, salt, null);","handlingStrategy":"validation","validationCode":"if (key != null && key.Length > 32)\n    key = DeriveSubkey(key, 32); // HKDF/PBKDF2 with 32-byte output\nvar digest = new Blake2sDigest(key, 32, salt, pers);","typeGuard":"static bool IsValidKey(byte[] key) => key == null || key.Length <= 32;","tryCatchPattern":"try { var d = new Blake2sDigest(key, 32, salt, pers); }\ncatch (ArgumentException ex) { /* derive 32-byte key and retry */ }","preventionTips":["Derive long keys to 32 bytes via KDF before use","Note Blake2s (32B) vs Blake2b (64B) key limits when porting","Validate key length at config-load time"],"tags":["csharp","cryptography","argument-validation","blake2s"],"backgroundTag":"invalid-key-length","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}