jstedfast/MailKit · error · ArgumentException

Invalid key length.

Error message

Invalid key length.

What it means

Guard in the RC4.Key property setter: the provided key byte array was empty (zero-length), which RC4 cannot use as key material; ArgumentException('Invalid key length.') is thrown. This is an input validation guard on key size, not an algorithm failure.

Solutions

1. Verify the key material length is >= 1 byte before assigning RC4.Key
2. Fix the upstream key derivation that returned an empty array
3. Generate a proper key (e.g. 16-byte NTLMv2 session key) if none was negotiated
4. Wrap in try-catch (ArgumentException) and surface a clear 'missing key material' error

Example fix

// before
rc4.Key = derivedKey ?? Array.Empty<byte>(); // empty array throws
// after
if (derivedKey == null || derivedKey.Length == 0)
    throw new InvalidOperationException("no NTLM key material available");
rc4.Key = derivedKey;

if (key == null || key.Length == 0)
    throw new InvalidOperationException("No usable NTLM key material");

static bool IsNonEmptyKey(byte[] key) => key is { Length: > 0 };

try { rc4.Key = key; }
catch (ArgumentException ex) { throw new AuthenticationException("Empty NTLM session key", ex); }

When it happens

Trigger: Assigning a zero-length byte array (new byte[0] or Array.Empty<byte>()) to RC4.Key; key derivation producing an empty buffer.

Common situations: Failed NTLM key export/import (EXPORT/40-bit restrictions yielding empty material); misconfigured key generation that returns empty arrays; slicing operations that produce empty spans.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Operation is not valid due to the current state of the…
• Value cannot be null.
• Specified argument was out of the range of valid values.
• Can only transform 8 bytes at a time.
• challenge

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/ccf6b59b78b766fe. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/RC4.cs:80

		}

		public int OutputBlockSize {
			get { return 1; }
		}

		public override byte[] Key {
			get {
				if (key == null)
					throw new InvalidOperationException ();

				return (byte[]) key.Clone ();
			}
			set {
				if (value == null)
					throw new ArgumentNullException (nameof (value));

				if (value.Length == 0)
					throw new ArgumentException ("Invalid key length.", nameof (value));

				KeySizeValue = value.Length << 3;
				key = (byte[]) value.Clone ();
				KeySetup (key);
			}
		}

		public override ICryptoTransform CreateEncryptor (byte[] rgbKey, byte[]? rgvIV)
		{
			return new RC4 { Key = rgbKey };
		}

		public override ICryptoTransform CreateDecryptor (byte[] rgbKey, byte[]? rgvIV)
		{
			return new RC4 { Key = rgbKey };
		}

		public override void GenerateIV ()

View on GitHub (pinned to 9d3859a785)