{"record":{"id":"d5d5316836e2741f","repo":"peass-ng/PEASS-ng","slug":"key-length-invalid-key-needs-to-be-32-byte-256","errorCode":null,"errorMessage":"Key length invalid. Key needs to be 32 byte - 256 bit!!!","messagePattern":"Key length invalid\\. Key needs to be 32 byte - 256 bit!!!","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/engines/Gost28147Engine.cs","lineNumber":234,"sourceCode":"\n\t\t\tGost28147Func(workingKey, input, inOff, output, outOff);\n\n\t\t\treturn BlockSize;\n\t\t}\n\n\t\tpublic virtual void Reset()\n\t\t{\n\t\t}\n\n\t\tprivate int[] generateWorkingKey(\n\t\t\tbool forEncryption,\n\t\t\tbyte[] userKey)\n\t\t{\n\t\t\tthis.forEncryption = forEncryption;\n\n\t\t\tif (userKey.Length != 32)\n\t\t\t{\n\t\t\t\tthrow new ArgumentException(\"Key length invalid. Key needs to be 32 byte - 256 bit!!!\");\n\t\t\t}\n\n\t\t\tint[] key = new int[8];\n\t\t\tfor (int i = 0; i != 8; i++)\n\t\t\t{\n\t\t\t\tkey[i] = bytesToint(userKey, i * 4);\n\t\t\t}\n\n\t\t\treturn key;\n\t\t}\n\n\t\tprivate int Gost28147_mainStep(int n1, int key)\n\t\t{\n\t\t\tint cm = (key + n1); // CM1\n\n\t\t\t// S-box replacing\n\n\t\t\tint om = S[0 + ((cm >> (0 * 4)) & 0xF)] << (0 * 4);","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/engines/Gost28147Engine.cs#L216-L252","documentation":"Gost28147Engine.Init throws this ArgumentException when the supplied key byte array is not exactly 32 bytes (256 bits). The GOST 28147-89 cipher is defined only for 256-bit keys; generateWorkingKey converts the user key into 8 32-bit subkey words and cannot process any other length.","triggerScenarios":"Calling Gost28147Engine.Init with a KeyParameter whose key byte[] length differs from 32 (e.g. a 16-byte AES key, 24-byte key, or an empty/nil key).","commonSituations":"Reusing key material generated for AES (128/192-bit) or DES (56/64-bit) with GOST; truncating or concatenating keys from config; decoding a base64/hex key that yields the wrong number of bytes.","solutions":["Generate or supply a key of exactly 32 bytes (256 bits) before calling Init","Derive a 32-byte key from arbitrary input with a KDF such as SHA-256 or PBKDF2 instead of truncating/padding","Check the decoding path (hex/base64) of the key material — a wrong decode commonly yields a shorter array"],"exampleFix":"// before\nbyte[] key = Encoding.UTF8.GetBytes(\"my-password\");\nengine.Init(true, new KeyParameter(key));\n// after\nbyte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(\"my-password\"));\nengine.Init(true, new KeyParameter(key));","handlingStrategy":"validation","validationCode":"if (key == null || key.Length != 32) throw new ArgumentException(\"GOST key must be exactly 32 bytes\");\nengine.Init(forEncryption, new KeyParameter(key));","typeGuard":"bool IsValidGostKey(byte[] key) => key != null && key.Length == 32;","tryCatchPattern":"try { engine.Init(forEncryption, new KeyParameter(key)); }\ncatch (ArgumentException ex) { /* log ex.Message; reject key material */ }","preventionTips":["Store GOST keys as 256-bit values and assert length == 32 after any decode","Use a KDF (SHA-256/PBKDF2) to normalize arbitrary passphrase material to 32 bytes","Add a unit test asserting Init accepts only 32-byte keys"],"tags":["csharp","cryptography","key-size","gost"],"backgroundTag":"invalid-cipher-key-size","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}