{"record":{"id":"e8e1d3e15877ab70","repo":"peass-ng/PEASS-ng","slug":"salt-length-must-be-exactly-8-bytes","errorCode":null,"errorMessage":"Salt length must be exactly 8 bytes","messagePattern":"Salt length must be exactly 8 bytes","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs","lineNumber":219,"sourceCode":"         *\n         * @param key             a key up to 32 bytes or null\n         * @param digestBytes     from 1 up to 32 bytes\n         * @param salt            8 bytes or null\n         * @param personalization 8 bytes or null\n         */\n        public Blake2sDigest(byte[] key, int digestBytes, byte[] salt,\n                             byte[] personalization)\n        {\n            if (digestBytes < 1 || digestBytes > 32)\n                throw new ArgumentException(\"Invalid digest length (required: 1 - 32)\");\n\n            this.digestLength = digestBytes;\n            this.buffer = new byte[BLOCK_LENGTH_BYTES];\n\n            if (salt != null)\n            {\n                if (salt.Length != 8)\n                    throw new ArgumentException(\"Salt length must be exactly 8 bytes\");\n\n                this.salt = new byte[8];\n                Array.Copy(salt, 0, this.salt, 0, salt.Length);\n            }\n            if (personalization != null)\n            {\n                if (personalization.Length != 8)\n                    throw new ArgumentException(\"Personalization length must be exactly 8 bytes\");\n\n                this.personalization = new byte[8];\n                Array.Copy(personalization, 0, this.personalization, 0, personalization.Length);\n            }\n            if (key != null)\n            {\n                if (key.Length > 32)\n                    throw new ArgumentException(\"Keys > 32 bytes are not supported\");\n\n                this.key = new byte[key.Length];","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/peass-ng/PEASS-ng/blob/53fb989abc2219826385683a6fee826bd6cd38d6/winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs#L201-L237","documentation":"Blake2s's parameter block reserves exactly 8 bytes for the salt field. The constructor copies the salt into a fixed 8-byte array, so it throws ArgumentException when salt != null but salt.Length != 8.","triggerScenarios":"Calling new Blake2sDigest(key, digestBytes, salt, personalization) with a non-null salt that is not exactly 8 bytes long (e.g. 16-byte random nonce, 4-byte seed, empty array, or Base64-decoded salt of another size).","commonSituations":"Using a standard 16-byte AES IV or random nonce as the Blake2 salt; forgetting the algorithm-specific 8-byte requirement when porting from another hash; truncating/zero-padding salts incorrectly.","solutions":["Provide exactly 8 bytes of salt; truncate a longer value or right-pad a shorter one with zeros to 8 bytes.","Pass null for salt if randomized salting is not required (the parameter block is then zero-filled).","Validate the salt length before constructing the digest."],"exampleFix":"// before\nbyte[] salt = new byte[16]; // 16-byte nonce\nvar digest = new Blake2sDigest(null, 32, salt, null);\n// after\nbyte[] salt8 = new byte[8];\nArray.Copy(salt, salt8, 8); // truncate to 8 bytes\nvar digest = new Blake2sDigest(null, 32, salt8, null);","handlingStrategy":"validation","validationCode":"if (salt != null && salt.Length != 8)\n    throw new ArgumentException(\"Blake2s salt must be exactly 8 bytes\");\nvar digest = new Blake2sDigest(key, 32, salt, pers);","typeGuard":"static bool IsValidSalt(byte[] salt) => salt == null || salt.Length == 8;","tryCatchPattern":"try { var d = new Blake2sDigest(key, 32, salt, pers); }\ncatch (ArgumentException ex) { /* pad/truncate salt or pass null */ }","preventionTips":["Allocate salts as exactly 8 bytes at generation time","Pad/truncate in one shared helper","Pass null when salting is not required"],"tags":["csharp","cryptography","argument-validation","blake2s"],"backgroundTag":"invalid-salt-length","analyzedSha":"53fb989abc2219826385683a6fee826bd6cd38d6","analyzedAt":"2026-09-02T04:25:09.259Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T11:17:12.671Z"}