{"record":{"id":"ccf6b59b78b766fe","repo":"jstedfast/MailKit","slug":"invalid-key-length","errorCode":null,"errorMessage":"Invalid key length.","messagePattern":"Invalid key length\\.","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/Ntlm/RC4.cs","lineNumber":80,"sourceCode":"\t\t}\n\n\t\tpublic int OutputBlockSize {\n\t\t\tget { return 1; }\n\t\t}\n\n\t\tpublic override byte[] Key {\n\t\t\tget {\n\t\t\t\tif (key == null)\n\t\t\t\t\tthrow new InvalidOperationException ();\n\n\t\t\t\treturn (byte[]) key.Clone ();\n\t\t\t}\n\t\t\tset {\n\t\t\t\tif (value == null)\n\t\t\t\t\tthrow new ArgumentNullException (nameof (value));\n\n\t\t\t\tif (value.Length == 0)\n\t\t\t\t\tthrow new ArgumentException (\"Invalid key length.\", nameof (value));\n\n\t\t\t\tKeySizeValue = value.Length << 3;\n\t\t\t\tkey = (byte[]) value.Clone ();\n\t\t\t\tKeySetup (key);\n\t\t\t}\n\t\t}\n\n\t\tpublic override ICryptoTransform CreateEncryptor (byte[] rgbKey, byte[]? rgvIV)\n\t\t{\n\t\t\treturn new RC4 { Key = rgbKey };\n\t\t}\n\n\t\tpublic override ICryptoTransform CreateDecryptor (byte[] rgbKey, byte[]? rgvIV)\n\t\t{\n\t\t\treturn new RC4 { Key = rgbKey };\n\t\t}\n\n\t\tpublic override void GenerateIV ()","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/Ntlm/RC4.cs#L62-L98","documentation":"Guard in the RC4.Key property setter: the provided key byte array was empty (zero-length), which RC4 cannot use as key material; ArgumentException('Invalid key length.') is thrown. This is an input validation guard on key size, not an algorithm failure.","triggerScenarios":"Assigning a zero-length byte array (new byte[0] or Array.Empty<byte>()) to RC4.Key; key derivation producing an empty buffer.","commonSituations":"Failed NTLM key export/import (EXPORT/40-bit restrictions yielding empty material); misconfigured key generation that returns empty arrays; slicing operations that produce empty spans.","solutions":["Verify the key material length is >= 1 byte before assigning RC4.Key","Fix the upstream key derivation that returned an empty array","Generate a proper key (e.g. 16-byte NTLMv2 session key) if none was negotiated","Wrap in try-catch (ArgumentException) and surface a clear 'missing key material' error"],"exampleFix":"// before\nrc4.Key = derivedKey ?? Array.Empty<byte>(); // empty array throws\n// after\nif (derivedKey == null || derivedKey.Length == 0)\n    throw new InvalidOperationException(\"no NTLM key material available\");\nrc4.Key = derivedKey;","handlingStrategy":"validation","validationCode":"if (key == null || key.Length == 0)\n    throw new InvalidOperationException(\"No usable NTLM key material\");","typeGuard":"static bool IsNonEmptyKey(byte[] key) => key is { Length: > 0 };","tryCatchPattern":"try { rc4.Key = key; }\ncatch (ArgumentException ex) { throw new AuthenticationException(\"Empty NTLM session key\", ex); }","preventionTips":["Treat zero-length derived keys as derivation failures, not valid keys","Validate key length against RC4's 1-256 byte support","Test the full handshake so empty-key paths surface early"],"tags":["ntlm","rc4","key-length","encryption"],"backgroundTag":"invalid-config-value","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}