peass-ng/PEASS-ng · error · ArgumentException

baseDigest output not large enough to support length

Error message

baseDigest output not large enough to support length

What it means

ShortenedDigest can only truncate to length bytes at most as large as the base digest's output. The constructor throws ArgumentException when length > baseDigest.GetDigestSize(), since it cannot produce more bytes than the underlying algorithm provides.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/ShortenedDigest.cs:33

		/**
		* Base constructor.
		*
		* @param baseDigest underlying digest to use.
		* @param length length in bytes of the output of doFinal.
		* @exception ArgumentException if baseDigest is null, or length is greater than baseDigest.GetDigestSize().
		*/
		public ShortenedDigest(
			IDigest	baseDigest,
			int		length)
		{
			if (baseDigest == null)
			{
				throw new ArgumentNullException("baseDigest");
			}

			if (length > baseDigest.GetDigestSize())
			{
				throw new ArgumentException("baseDigest output not large enough to support length");
			}

			this.baseDigest = baseDigest;
			this.length = length;
		}

		public string AlgorithmName
		{
			get { return baseDigest.AlgorithmName + "(" + length * 8 + ")"; }
		}

		public int GetDigestSize()
		{
			return length;
		}

		public void Update(byte input)
		{

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass length <= baseDigest.GetDigestSize() in bytes.
2. Use a larger base digest (e.g. Sha512Digest) if you need longer output.
3. Check GetDigestSize() at runtime before construction.

Example fix

// before
var d = new ShortenedDigest(new Sha1Digest(), 32);
// after
var d = new ShortenedDigest(new Sha256Digest(), 32);

if (length > baseDigest.GetDigestSize()) throw new ArgumentOutOfRangeException(nameof(length));

bool CanShorten(IDigest baseDigest, int length) => baseDigest != null && length <= baseDigest.GetDigestSize();

try { d = new ShortenedDigest(baseDigest, len); }
catch (ArgumentException) { d = new ShortenedDigest(new Sha512Digest(), len); }

When it happens

Trigger: new ShortenedDigest(new Md5Digest(), 32) — requesting 32 bytes from a 16-byte digest; similarly Sha1 with length > 20.

Common situations: Requesting SHA-256-sized output while wrapping SHA-1; configuring 'shortened' sizes without checking the base algorithm's digest size.

Related errors

• cannot be >= 512
• needs to be a multiple of 8
• cannot be 384 use SHA384 instead
• BLAKE2b digest bit length must be a multiple of 8 and not gr
• Invalid digest length (required: 1 - 64)

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/1d10165dda85a7d0. Report an issue: GitHub.