{"record":{"id":"e1667b422ed8e13e","repo":"jstedfast/MailKit","slug":"invalid-key-size","errorCode":null,"errorMessage":"Invalid key size.","messagePattern":"Invalid key size\\.","errorType":"validation","errorClass":"CryptographicException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/Ntlm/DES.cs","lineNumber":166,"sourceCode":"\t\t\t}\n\t\t}\n\n\t\tpublic override ICryptoTransform CreateDecryptor (byte[] rgbKey, byte[] rgbIV)\n\t\t{\n\t\t\treturn new DesTransform (false, rgbKey);\n\t\t}\n\n\t\tpublic override ICryptoTransform CreateEncryptor (byte[] rgbKey, byte[] rgbIV)\n\t\t{\n\t\t\treturn new DesTransform (true, rgbKey);\n\t\t}\n\n\t\t// The following code is Copyright (C) Microsoft Corporation. All rights reserved.\n\n\t\tpublic static bool IsWeakKey (byte[] rgbKey)\n\t\t{\n\t\t\tif (!IsLegalKeySize (rgbKey))\n\t\t\t\tthrow new CryptographicException (\"Invalid key size.\");\n\n\t\t\tbyte[] rgbOddParityKey = FixupKeyParity (rgbKey);\n\t\t\tulong key = QuadWordFromBigEndian (rgbOddParityKey);\n\n\t\t\treturn ((key == 0x0101010101010101) ||\n\t\t\t\t(key == 0xfefefefefefefefe) ||\n\t\t\t\t(key == 0x1f1f1f1f0e0e0e0e) ||\n\t\t\t\t(key == 0xe0e0e0e0f1f1f1f1));\n\t\t}\n\n\t\tpublic static bool IsSemiWeakKey (byte[] rgbKey)\n\t\t{\n\t\t\tif (!IsLegalKeySize (rgbKey))\n\t\t\t\tthrow new CryptographicException (\"Invalid key size.\");\n\n\t\t\tbyte[] rgbOddParityKey = FixupKeyParity (rgbKey);\n\t\t\tulong key = QuadWordFromBigEndian (rgbOddParityKey);\n","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/Ntlm/DES.cs#L148-L184","documentation":"DES.IsWeakKey throws CryptographicException(\"Invalid key size.\") when the candidate key array is not exactly 8 bytes (the legal DES key size), because IsLegalKeySize fails. The check for weak keys is meaningless for other sizes.","triggerScenarios":"Calling DES.IsWeakKey with a byte[] shorter or longer than 8 bytes, e.g. a 16-byte NTLM key intended for DES3.","commonSituations":"NTLM session security key derivation passing a padded/concatenated key of the wrong length into weak-key screening.","solutions":["Ensure the key passed to IsWeakKey is exactly 8 bytes","Trim or split longer keys into 8-byte halves before checking","Catch CryptographicException and re-derive the key at the correct size"],"exampleFix":"// before\nDES.IsWeakKey(ntlmKey); // 16 bytes\n// after\nif (ntlmKey.Length == 8)\n\tDES.IsWeakKey(ntlmKey);","handlingStrategy":"validation","validationCode":"if (key == null || key.Length != 8) throw new ArgumentException(\"DES key must be 8 bytes\");","typeGuard":"bool IsDesKey(byte[] k) => k != null && k.Length == 8;","tryCatchPattern":"try { weak = DES.IsWeakKey(key); } catch (CryptographicException) { /* re-derive key */ }","preventionTips":["Check key length == 8 after every derivation step","Split 16-byte NTLM keys into halves before DES ops","Log key lengths (not values) in crypto diagnostics"],"tags":["csharp","crypto","key-size"],"backgroundTag":"invalid-config-value","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}