peass-ng/PEASS-ng · error · ArgumentException

cannot be >= 512

Error message

cannot be >= 512

What it means

Sha512tDigest implements SHA-512/t, a truncated variant of SHA-512. The constructor validates bitLength and rejects any value >= 512 because the whole point of this digest is a truncated output shorter than 512 bits; for 512 you should use the plain Sha512Digest. BouncyCastle throws ArgumentException with the parameter name to signal an invalid constructor argument.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Sha512tDigest.cs:24

    /**
     * FIPS 180-4 implementation of SHA-512/t
     */
    public class Sha512tDigest
        : LongDigest
    {
        private const ulong A5 = 0xa5a5a5a5a5a5a5a5UL;

        private readonly int digestLength;

        private ulong H1t, H2t, H3t, H4t, H5t, H6t, H7t, H8t;

        /**
         * Standard constructor
         */
        public Sha512tDigest(int bitLength)
        {
            if (bitLength >= 512)
                throw new ArgumentException("cannot be >= 512", "bitLength");
            if (bitLength % 8 != 0)
                throw new ArgumentException("needs to be a multiple of 8", "bitLength");
            if (bitLength == 384)
                throw new ArgumentException("cannot be 384 use SHA384 instead", "bitLength");

            this.digestLength = bitLength / 8;

            tIvGenerate(digestLength * 8);

            Reset();
        }

        /**
         * Copy constructor.  This will copy the state of the provided
         * message digest.
         */
        public Sha512tDigest(Sha512tDigest t)
            : base(t)

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass a bitLength strictly less than 512 and a multiple of 8 that is not 384 (e.g. 224, 256).
2. If you need a full 512-bit digest, use Sha512Digest instead of Sha512tDigest.
3. If the value comes from user config, clamp or map it before constructing.

Example fix

// before
var digest = new Sha512tDigest(512);
// after
var digest = new Sha512Digest(); // or new Sha512tDigest(256);

bool IsValidSha512tBitLength(int bitLength) => bitLength < 512 && bitLength % 8 == 0 && bitLength != 384;

bool IsValidSha512tBitLength(int bitLength) => bitLength is < 512 and not 384 && bitLength % 8 == 0;

try { var d = new Sha512tDigest(bits); }
catch (ArgumentException ex) when (ex.ParamName == "bitLength") { /* fall back to Sha512Digest or a default size */ }

When it happens

Trigger: Calling new Sha512tDigest(bitLength) with bitLength >= 512 (e.g. 512, 1024) or a value read from config that equals a full SHA-512 size.

Common situations: Configuring the algorithm name as 'SHA-512' and parsing the number to pass as bitLength; confusing SHA-512 with SHA-512/t when migrating code between digest classes.

Related errors

• needs to be a multiple of 8
• cannot be 384 use SHA384 instead
• baseDigest output not large enough to support length
• BLAKE2b digest bit length must be a multiple of 8 and not gr
• Invalid digest length (required: 1 - 64)

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/e1a1cdb57af9cf84. Report an issue: GitHub.