jstedfast/MailKit · error · CryptographicException

Invalid key size.

Error message

Invalid key size.

What it means

DES.IsWeakKey throws CryptographicException("Invalid key size.") when the candidate key array is not exactly 8 bytes (the legal DES key size), because IsLegalKeySize fails. The check for weak keys is meaningless for other sizes.

Solutions

1. Ensure the key passed to IsWeakKey is exactly 8 bytes
2. Trim or split longer keys into 8-byte halves before checking
3. Catch CryptographicException and re-derive the key at the correct size

Example fix

// before
DES.IsWeakKey(ntlmKey); // 16 bytes
// after
if (ntlmKey.Length == 8)
	DES.IsWeakKey(ntlmKey);

if (key == null || key.Length != 8) throw new ArgumentException("DES key must be 8 bytes");

bool IsDesKey(byte[] k) => k != null && k.Length == 8;

try { weak = DES.IsWeakKey(key); } catch (CryptographicException) { /* re-derive key */ }

When it happens

Trigger: Calling DES.IsWeakKey with a byte[] shorter or longer than 8 bytes, e.g. a 16-byte NTLM key intended for DES3.

Common situations: NTLM session security key derivation passing a padded/concatenated key of the wrong length into weak-key screening.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• inputBuffer
• inputCount
• inputOffset
• outputOffset
• ArgumentNullException

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/e1667b422ed8e13e. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/DES.cs:166

			}
		}

		public override ICryptoTransform CreateDecryptor (byte[] rgbKey, byte[] rgbIV)
		{
			return new DesTransform (false, rgbKey);
		}

		public override ICryptoTransform CreateEncryptor (byte[] rgbKey, byte[] rgbIV)
		{
			return new DesTransform (true, rgbKey);
		}

		// The following code is Copyright (C) Microsoft Corporation. All rights reserved.

		public static bool IsWeakKey (byte[] rgbKey)
		{
			if (!IsLegalKeySize (rgbKey))
				throw new CryptographicException ("Invalid key size.");

			byte[] rgbOddParityKey = FixupKeyParity (rgbKey);
			ulong key = QuadWordFromBigEndian (rgbOddParityKey);

			return ((key == 0x0101010101010101) ||
				(key == 0xfefefefefefefefe) ||
				(key == 0x1f1f1f1f0e0e0e0e) ||
				(key == 0xe0e0e0e0f1f1f1f1));
		}

		public static bool IsSemiWeakKey (byte[] rgbKey)
		{
			if (!IsLegalKeySize (rgbKey))
				throw new CryptographicException ("Invalid key size.");

			byte[] rgbOddParityKey = FixupKeyParity (rgbKey);
			ulong key = QuadWordFromBigEndian (rgbOddParityKey);

View on GitHub (pinned to 9d3859a785)