gchq/CyberChef · error · OperationError

Key cannot be greater than 32 bytes It is currently " + key.

Error message

Key cannot be greater than 32 bytes
It is currently " + key.length + " bytes.

What it means

Thrown by BLAKE2s.run when the optional key exceeds 32 bytes. BLAKE2s (the 32-bit variant) accepts a keyed-digest mode with a maximum key of 32 bytes (its block size is 64 bytes but the key field is limited to 32); longer keys are rejected. The key is decoded via Utils.convertToByteArray and an empty key is allowed (unkeyed hashing).

Source

Thrown at src/core/operations/BLAKE2s.mjs:62

                "type": "toggleString",
                "value": "",
                "toggleValues": ["UTF8", "Decimal", "Base64", "Hex", "Latin1"]
            }
        ];
    }

    /**
     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {string} The input having been hashed with BLAKE2s in the encoding format specified.
     */
    run(input, args) {
        const [outSize, outFormat] = args;
        let key = Utils.convertToByteArray(args[2].string || "", args[2].option);
        if (key.length === 0) {
            key = null;
        } else if (key.length > 32) {
            throw new OperationError(["Key cannot be greater than 32 bytes", "It is currently " + key.length + " bytes."].join("\n"));
        }

        input = new Uint8Array(input);
        switch (outFormat) {
            case "Hex":
                return blakejs.blake2sHex(input, key, outSize / 8);
            case "Base64":
                return toBase64(blakejs.blake2s(input, key, outSize / 8));
            case "Raw":
                return Utils.arrayBufferToStr(blakejs.blake2s(input, key, outSize / 8).buffer);
            default:
                return new OperationError("Unsupported Output Type");
        }
    }

}

export default BLAKE2s;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Trim or hash the key material down to at most 32 bytes before passing it.
2. Use a KDF to derive a <=32-byte key from a passphrase.
3. If you need a longer key, switch to BLAKE2b (max 64 bytes).

Example fix

// before - 48-byte key
chef.blake2s(input, { key: "00..." /* 96 hex chars */, keyOption: "Hex" });

// after - 32-byte key (64 hex chars)
chef.blake2s(input, { key: "00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", keyOption: "Hex" });

import Utils from "src/core/Utils.mjs";
function assertBlake2sKey(keyStr, keyOption) {
  if (!keyStr) return null;
  const bytes = Utils.convertToByteArray(keyStr, keyOption);
  if (bytes.length > 32) throw new Error(`BLAKE2s key max 32 bytes, got ${bytes.length}`);
  return bytes;
}
assertBlake2sKey(key, keyOption);

function isAtMostNBytes(s, option, n) {
  if (option === "Hex") return /^[0-9a-f]{0,2*n}$/i.test(s);
  return false;
}

When it happens

Trigger: Supplying a key longer than 32 decoded bytes: a long passphrase, a >64-hex-char string, or base64 decoding to >32 bytes.

Common situations: Using a passphrase longer than 32 bytes; reusing a 256-bit key plus extra; confusing BLAKE2b (64-byte max) with BLAKE2s (32-byte max).

Related errors

• Key cannot be greater than 64 bytes It is currently " + key.
• The key must be exactly 32 bytes long
• Invalid key length: ${key.length} bytes. Ascon-AEAD128 requ
• Invalid key length: ${key.length} bytes. Ascon-AEAD128 requ
• Invalid key length: ${keyArray.length} bytes. Ascon-Mac req

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/026c65a46d63ec74. Report an issue: GitHub.