jstedfast/MailKit · error · ArgumentException

Invalid nonce length (should be 8 bytes).

Error message

Invalid nonce length (should be 8 bytes).

What it means

Setting the ClientChallenge property throws ArgumentException "Invalid nonce length (should be 8 bytes)." when the supplied byte[] is not exactly 8 bytes long. The NTLM client nonce is a fixed 64-bit value.

Solutions

1. Pass exactly 8 bytes (e.g. RandomNumberGenerator.GetBytes(8) or NtlmUtils.NONCE(8)).
2. Check value.Length == 8 before assigning.
3. Note that assigning null is silently ignored by this setter; only wrong-length non-null arrays throw.

Example fix

// before
auth.ClientChallenge = RandomNumberGenerator.GetBytes(16); // 16 bytes
// after
auth.ClientChallenge = RandomNumberGenerator.GetBytes(8); // exactly 8 bytes

if (clientChallenge is { Length: not 8 }) throw new ArgumentException("ClientChallenge must be exactly 8 bytes.");
auth.ClientChallenge = clientChallenge;

static bool IsValidNonce(byte[]? nonce) => nonce == null || nonce.Length == 8;

try {
	auth.ClientChallenge = nonce;
} catch (ArgumentException ex) when (ex.Message.Contains("nonce length")) {
	// regenerate a correct-size nonce
	auth.ClientChallenge = NtlmUtils.NONCE(8);
}

When it happens

Trigger: Assigning ClientChallenge = someBytes where someBytes.Length != 8 — e.g. a 16-byte random buffer, or a hex/FromBase64-decoded value of unexpected length.

Common situations: Generating a nonce with the wrong size (RandomNumberGenerator.GetBytes(16)); hand-crafted NTLMv2 tests; truncating/padding mistakes.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Invalid nonce length (should be 8 bytes).
• value
• HashAlgorithm
• No hash value computed.
• negotiate

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/476685dbdf486d80. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/NtlmAuthenticateMessage.cs:138

			if (ExportedSessionKey != null)
				Array.Clear (ExportedSessionKey, 0, ExportedSessionKey.Length);

			if (EncryptedRandomSessionKey != null)
				Array.Clear (EncryptedRandomSessionKey, 0, EncryptedRandomSessionKey.Length);
		}

		/// <summary>
		/// This is only used for unit testing purposes.
		/// </summary>
		internal byte[]? ClientChallenge {
			get { return clientChallenge; }
			set {
				if (value == null)
					return;

				if (value.Length != 8)
					throw new ArgumentException ("Invalid nonce length (should be 8 bytes).", nameof (value));

				Array.Clear (clientChallenge, 0, clientChallenge.Length);
				clientChallenge = value;
			}
		}

		/// <summary>
		/// This is only used for unit testing purposes.
		/// </summary>
		internal long? Timestamp {
			get; set;
		}

		public string Domain {
			get; private set;
		}

		public string Workstation {

View on GitHub (pinned to 9d3859a785)