gchq/CyberChef · error · OperationError

L too large (maximum length for ${args[2]} is ${255 * HashLe

Error message

L too large (maximum length for ${args[2]} is ${255 * HashLen})

What it means

Thrown by Derive HKDF Key run() when L exceeds 255 * HashLen - the RFC 5869 hard limit (N <= 255*HashLen, since the expand loop uses a single counter byte T(i)). HashLen is the digest length of the selected hashing function (e.g. 32 for SHA-256, 64 for SHA-512). The error message reports the exact maximum for the chosen hash.

Source

Thrown at src/core/operations/DeriveHKDFKey.mjs:115

     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {ArrayBuffer}
     */
    run(input, args) {
        const argSalt = Utils.convertToByteString(args[0].string || "", args[0].option),
            info = Utils.convertToByteString(args[1].string || "", args[1].option),
            hashFunc = args[2].toLowerCase(),
            extractMode = args[3],
            L = args[4],
            IKM = Utils.arrayBufferToStr(input, false),
            hasher = CryptoApi.getHasher(hashFunc),
            HashLen = hasher.finalize().length;

        if (L < 0) {
            throw new OperationError("L must be non-negative");
        }
        if (L > 255 * HashLen) {
            throw new OperationError("L too large (maximum length for " + args[2] + " is " + (255 * HashLen) + ")");
        }

        const hmacHash = function(key, data) {
            hasher.reset();
            const mac = CryptoApi.getHmac(key, hasher);
            mac.update(data);
            return mac.finalize();
        };
        const salt = extractMode === "with salt" ? argSalt : "\0".repeat(HashLen);
        const PRK = extractMode === "skip" ? IKM : hmacHash(salt, IKM);
        let T = "";
        let result = "";
        for (let i = 1; i <= 255 && result.length < L; i++) {
            const TNext = hmacHash(PRK, T + info + String.fromCharCode(i));
            result += TNext;
            T = TNext;
        }
        return CryptoApi.encoder.toHex(result.substring(0, L));

View on GitHub (pinned to 4290ea7539)

Solutions

1. Reduce L to within 255*HashLen for the selected hash (use the value shown in the error message).
2. Switch to a longer-output hash (e.g. SHA-512) if more derived material is genuinely needed.
3. Derive multiple independent keys with different `info` contexts instead of one oversized L.

Example fix

// before
Hashing function: SHA-256, L: 10000  // > 8160 -> error

// after
Hashing function: SHA-256, L: 8160   // or switch to SHA-512 for up to 16320

import CryptoApi from "crypto-api/src/crypto-api.mjs";

function maxHkdfLength(hashName) {
    const hasher = CryptoApi.getHasher(hashName.toLowerCase());
    return 255 * hasher.finalize().length;
}
function withinHkdfLimit(L, hashName) {
    return L >= 0 && L <= maxHkdfLength(hashName);
}

/** @returns {boolean} */
function isWithinHkdfLimit(L, hashName) {
    try {
        const hasher = CryptoApi.getHasher(String(hashName).toLowerCase());
        return Number.isInteger(L) && L >= 0 && L <= 255 * hasher.finalize().length;
    } catch {
        return false;
    }
}

try {
    out = deriveHkdfKey.run(input, args);
} catch (e) {
    if (e instanceof OperationError && /L too large/.test(e.message)) {
        // switch to a longer hash (SHA-512) or reduce L
        args[2] = "SHA512";
        out = deriveHkdfKey.run(input, args);
    } else throw e;
}

When it happens

Trigger: Setting L higher than 255*HashLen for the chosen hash. For SHA-256 the cap is 8160; for SHA-512 the cap is 16320; for MD5 it is 5100. Asking for, say, 10000 bytes with SHA-256 selected triggers it.

Common situations: Misunderstanding HKDF output limits and requesting a large key+IV bundle in one derivation; selecting a short hash (MD5/SHA1) while needing a long output; a recipe reusing an L tuned for SHA-512 on a SHA-256 configuration.

Related errors

• L must be non-negative
• Invalid IV length: ${iv.length} bytes TEA uses an IV length
• Invalid key length: ${key.length} bytes TEA requires a key
• Invalid IV length: ${iv.length} bytes TEA uses an IV length
• Byte length must be a positive integer

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/ae1664348ef40f4c. Report an issue: GitHub.