peass-ng/PEASS-ng · error · ArgumentException

Hash size is not recommended. Use 256/384/512 instead

Error message

Hash size is not recommended. Use 256/384/512 instead

What it means

DSTU 7564 (Ukrainian Kubeh hash) is only standardized for 256-, 384-, and 512-bit outputs; other sizes would require untested round/column parameters. The Dstu7564Digest(int hashSizeBits) constructor throws ArgumentException for any hashSizeBits other than 256, 384, or 512.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/DSTU7564Digest.cs:71

                this.state = Arrays.Clone(digest.state);
                this.tempState1 = new ulong[columns];
                this.tempState2 = new ulong[columns];
                this.buf = Arrays.Clone(digest.buf);
            }

            this.inputBlocks = digest.inputBlocks;
            this.bufOff = digest.bufOff;
        }

        public Dstu7564Digest(int hashSizeBits)
        {
            if (hashSizeBits == 256 || hashSizeBits == 384 || hashSizeBits == 512)
            {
                this.hashSize = hashSizeBits / 8;
            }
            else
            {
                throw new ArgumentException("Hash size is not recommended. Use 256/384/512 instead");
            }

            if (hashSizeBits > 256)
            {
                this.columns = NB_1024;
                this.rounds = NR_1024;
            }
            else
            {
                this.columns = NB_512;
                this.rounds = NR_512;
            }

            this.blockSize = columns << 3;

            this.state = new ulong[columns];
            this.state[0] = (ulong)blockSize;

View on GitHub (pinned to 53fb989abc)

Solutions

1. Pass exactly 256, 384, or 512 (bits) to the constructor.
2. If a 128- or 224-bit output is needed, choose another algorithm (e.g. SHA-256 truncated, or a different digest).
3. Validate the configured hash size against the allowed set before constructing.

Example fix

// before
var digest = new Dstu7564Digest(32); // bytes, not bits
// after
var digest = new Dstu7564Digest(256); // bits: 256|384|512

int[] allowed = { 256, 384, 512 };
if (Array.IndexOf(allowed, hashSizeBits) < 0)
    throw new ArgumentOutOfRangeException(nameof(hashSizeBits), "DSTU 7564 requires 256/384/512 bits");
var digest = new Dstu7564Digest(hashSizeBits);

static bool IsValidDstu7564Size(int bits) => bits == 256 || bits == 384 || bits == 512;

try { var d = new Dstu7564Digest(bits); }
catch (ArgumentException ex) { /* default to 512 or report config error */ }

When it happens

Trigger: Calling new Dstu7564Digest(hashSizeBits) with a value other than 256/384/512 — e.g. 128, 224, or a bit/byte confusion such as passing 32 instead of 256.

Common situations: Passing bit sizes from SHA-2 family configs (224); passing byte sizes (32/64) where bits are expected; guessing that smaller variants exist like in other hash families.

Related errors

• Keys > 32 are not supported
• Invalid digest length (required: 1 - 32)
• Salt length must be exactly 8 bytes
• Personalization length must be exactly 8 bytes
• Keys > 32 bytes are not supported

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/69cb6fb082df1e56. Report an issue: GitHub.