gchq/CyberChef · error · OperationError

Key cannot be greater than 64 bytes It is currently " + key.

Error message

Key cannot be greater than 64 bytes
It is currently " + key.length + " bytes.

What it means

Thrown by BLAKE2b.run when the optional key exceeds 64 bytes. BLAKE2b accepts a keyed-digest mode with a maximum key of 64 bytes (block size); longer keys are rejected rather than hashed down, because BLAKE2b's key schedule has fixed capacity for 64 key bytes. The key is decoded via Utils.convertToByteArray using the chosen input option, and an empty key is allowed (treated as unkeyed hashing).

Source

Thrown at src/core/operations/BLAKE2b.mjs:61

                "type": "toggleString",
                "value": "",
                "toggleValues": ["UTF8", "Decimal", "Base64", "Hex", "Latin1"]
            }
        ];
    }

    /**
     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {string} The input having been hashed with BLAKE2b in the encoding format specified.
     */
    run(input, args) {
        const [outSize, outFormat] = args;
        let key = Utils.convertToByteArray(args[2].string || "", args[2].option);
        if (key.length === 0) {
            key = null;
        } else if (key.length > 64) {
            throw new OperationError(["Key cannot be greater than 64 bytes", "It is currently " + key.length + " bytes."].join("\n"));
        }

        input = new Uint8Array(input);
        switch (outFormat) {
            case "Hex":
                return blakejs.blake2bHex(input, key, outSize / 8);
            case "Base64":
                return toBase64(blakejs.blake2b(input, key, outSize / 8));
            case "Raw":
                return Utils.arrayBufferToStr(blakejs.blake2b(input, key, outSize / 8).buffer);
            default:
                return new OperationError("Unsupported Output Type");
        }
    }

}

export default BLAKE2b;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Trim or hash the key material down to at most 64 bytes before passing it.
2. If you need to derive a key from a passphrase, use a KDF to produce a <=64-byte key.
3. Confirm the input option matches the encoding so the decoded length is what you expect.

Example fix

// before - passphrase longer than 64 bytes
chef.blake2b(input, { key: longPassphrase, keyOption: "UTF8" });

// after - pre-hash to 64 bytes
chef.blake2b(input, { key: sha512(longPassphrase), keyOption: "Hex" }); // 64 bytes

import Utils from "src/core/Utils.mjs";
function assertBlake2bKey(keyStr, keyOption) {
  if (!keyStr) return null;
  const bytes = Utils.convertToByteArray(keyStr, keyOption);
  if (bytes.length > 64) throw new Error(`BLAKE2b key max 64 bytes, got ${bytes.length}`);
  return bytes;
}
assertBlake2bKey(key, keyOption);

function isAtMostNBytes(s, option, n) {
  if (option === "Hex") return /^[0-9a-f]{0,2*n}$/i.test(s);
  return false;
}

When it happens

Trigger: Supplying a key longer than 64 decoded bytes: a long UTF-8 passphrase, a >128-hex-char string, or base64 decoding to >64 bytes.

Common situations: Using a long passphrase as the key; reusing a 512-bit (64-byte) key plus extra; hex miscount producing 65+ bytes.

Related errors

• Key cannot be greater than 32 bytes It is currently " + key.
• The key must be exactly 32 bytes long
• Invalid key length: ${key.length} bytes. Ascon-AEAD128 requ
• Invalid key length: ${key.length} bytes. Ascon-AEAD128 requ
• Invalid key length: ${keyArray.length} bytes. Ascon-Mac req

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/6538b77254c79a29. Report an issue: GitHub.