gchq/CyberChef · error · OperationError

Key cannot be greater than 32 bytes It is currently " +…

Error message

Key cannot be greater than 32 bytes
It is currently " + key.length + " bytes.

What it means

Thrown by BLAKE2s.run when the optional key exceeds 32 bytes. BLAKE2s (the 32-bit variant) accepts a keyed-digest mode with a maximum key of 32 bytes (its block size is 64 bytes but the key field is limited to 32); longer keys are rejected. The key is decoded via Utils.convertToByteArray and an empty key is allowed (unkeyed hashing).

Solutions

Trim or hash the key material down to at most 32 bytes before passing it.
Use a KDF to derive a <=32-byte key from a passphrase.
If you need a longer key, switch to BLAKE2b (max 64 bytes).

Example fix

// before - 48-byte key
chef.blake2s(input, { key: "00..." /* 96 hex chars */, keyOption: "Hex" });

// after - 32-byte key (64 hex chars)
chef.blake2s(input, { key: "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", keyOption: "Hex" });

Defensive patterns

Strategy: validation

Validate before calling

import Utils from "src/core/Utils.mjs";
function assertBlake2sKey(keyStr, keyOption) {
  if (!keyStr) return null;
  const bytes = Utils.convertToByteArray(keyStr, keyOption);
  if (bytes.length > 32) throw new Error(`BLAKE2s key max 32 bytes, got ${bytes.length}`);
  return bytes;
}
assertBlake2sKey(key, keyOption);

Type guard

function isAtMostNBytes(s, option, n) {
  if (option === "Hex") return /^[0-9a-f]{0,2*n}$/i.test(s);
  return false;
}

Prevention

Keep the BLAKE2s key <= 32 bytes (not 64 like BLAKE2b).
Hash long passphrases down to <= 32 bytes first.
Leave the key empty for unkeyed hashing.

When it happens

Trigger: Supplying a key longer than 32 decoded bytes: a long passphrase, a >64-hex-char string, or base64 decoding to >32 bytes.

Common situations: Using a passphrase longer than 32 bytes; reusing a 256-bit key plus extra; confusing BLAKE2b (64-byte max) with BLAKE2s (32-byte max).

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/026c65a46d63ec74. Report an issue: GitHub.

Appendix: source

Thrown at src/core/operations/BLAKE2s.mjs:62

                "type": "toggleString",
                "value": "",
                "toggleValues": ["UTF8", "Decimal", "Base64", "Hex", "Latin1"]
            }
        ];
    }

    /**
     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {string} The input having been hashed with BLAKE2s in the encoding format specified.
     */
    run(input, args) {
        const [outSize, outFormat] = args;
        let key = Utils.convertToByteArray(args[2].string || "", args[2].option);
        if (key.length === 0) {
            key = null;
        } else if (key.length > 32) {
            throw new OperationError(["Key cannot be greater than 32 bytes", "It is currently " + key.length + " bytes."].join("\n"));
        }

        input = new Uint8Array(input);
        switch (outFormat) {
            case "Hex":
                return blakejs.blake2sHex(input, key, outSize / 8);
            case "Base64":
                return toBase64(blakejs.blake2s(input, key, outSize / 8));
            case "Raw":
                return Utils.arrayBufferToStr(blakejs.blake2s(input, key, outSize / 8).buffer);
            default:
                return new OperationError("Unsupported Output Type");
        }
    }

}

export default BLAKE2s;

View on GitHub (pinned to 4290ea7539)