{"record":{"id":"cdf09179b3d73e09","repo":"peass-ng/PEASS-ng","slug":"keys-64-are-not-supported","errorCode":null,"errorMessage":"Keys > 64 are not supported","messagePattern":"Keys > 64 are not supported","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2bDigest.cs","lineNumber":164,"sourceCode":"        /**\n         * Blake2b for authentication (\"Prefix-MAC mode\").\n         * After calling the doFinal() method, the key will\n         * remain to be used for further computations of\n         * this instance.\n         * The key can be overwritten using the clearKey() method.\n         *\n         * @param key A key up to 64 bytes or null\n         */\n        public Blake2bDigest(byte[] key)\n        {\n            buffer = new byte[BLOCK_LENGTH_BYTES];\n            if (key != null)\n            {\n                this.key = new byte[key.Length];\n                Array.Copy(key, 0, this.key, 0, key.Length);\n\n                if (key.Length > 64)\n                    throw new ArgumentException(\"Keys > 64 are not supported\");\n\n                keyLength = key.Length;\n                Array.Copy(key, 0, buffer, 0, key.Length);\n                bufferPos = BLOCK_LENGTH_BYTES; // zero padding\n            }\n            digestLength = 64;\n            Init();\n        }\n\n        /**\n         * Blake2b with key, required digest length (in bytes), salt and personalization.\n         * After calling the doFinal() method, the key, the salt and the personal string\n         * will remain and might be used for further computations with this instance.\n         * The key can be overwritten using the clearKey() method, the salt (pepper)\n         * can be overwritten using the clearSalt() method.\n         *\n         * @param key             A key up to 64 bytes or null\n         * @param digestLength    from 1 up to 64 bytes","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2bDigest.cs#L146-L182","documentation":"BLAKE2b supports keyed hashing (MAC mode) with keys up to 64 bytes; this constructor overload rejects any longer key with an ArgumentException, thrown after the key has already been copied. The check enforces the BLAKE2b spec's 64-byte key limit.","triggerScenarios":"new Blake2bDigest(byte[] key) where key.Length > 64.","commonSituations":"Using 128-byte HMAC-style keys with BLAKE2b, generating keys with wrong parameters, concatenating secret material into an oversized key.","solutions":["Truncate or derive the key to <= 64 bytes (e.g. hash the long key first and use its digest as the BLAKE2b key)","Use the full constructor Blake2bDigest(key, digestLength, salt, personalization) after validating key length","Regenerate the key with the correct 64-byte maximum length"],"exampleFix":"// before\nvar d = new Blake2bDigest(longKey); // longKey.Length = 128\n// after\nif (longKey.Length > 64)\n    longKey = new Sha512Digest(); /* derive via hash */ ;\nvar d = new Blake2bDigest(TruncateTo64(longKey));","handlingStrategy":"validation","validationCode":"bool IsValidBlake2bKey(byte[] key) => key == null || key.Length <= 64;","typeGuard":null,"tryCatchPattern":"try { var d = new Blake2bDigest(key); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"Keys > 64\")) {\n    key = DeriveKey64(key); var d = new Blake2bDigest(key);\n}","preventionTips":["Cap BLAKE2b keys at 64 bytes","Hash over-long keys with SHA-512 to derive a usable key","Validate key material at load time"],"tags":["csharp","bouncycastle","blake2b","key-length"],"backgroundTag":"key-size-not-supported","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}