peass-ng/PEASS-ng · error · ArgumentException

Invalid digest length (required: 1 - 32)

Error message

Invalid digest length (required: 1 - 32)

What it means

Blake2s produces between 1 and 32 bytes of output (digest length is written into the parameter block). The full constructor Blake2sDigest(key, digestBytes, salt, personalization) validates digestBytes and throws ArgumentException for any value outside 1..32.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2sDigest.cs:211

        /**
         * BLAKE2s with key, required digest length, salt and personalization.
         * <p/>
         * After calling the doFinal() method, the key, the salt and the personal
         * string will remain and might be used for further computations with this
         * instance. The key can be overwritten using the clearKey() method, the
         * salt (pepper) can be overwritten using the clearSalt() method.
         *
         * @param key             a key up to 32 bytes or null
         * @param digestBytes     from 1 up to 32 bytes
         * @param salt            8 bytes or null
         * @param personalization 8 bytes or null
         */
        public Blake2sDigest(byte[] key, int digestBytes, byte[] salt,
                             byte[] personalization)
        {
            if (digestBytes < 1 || digestBytes > 32)
                throw new ArgumentException("Invalid digest length (required: 1 - 32)");

            this.digestLength = digestBytes;
            this.buffer = new byte[BLOCK_LENGTH_BYTES];

            if (salt != null)
            {
                if (salt.Length != 8)
                    throw new ArgumentException("Salt length must be exactly 8 bytes");

                this.salt = new byte[8];
                Array.Copy(salt, 0, this.salt, 0, salt.Length);
            }
            if (personalization != null)
            {
                if (personalization.Length != 8)
                    throw new ArgumentException("Personalization length must be exactly 8 bytes");

                this.personalization = new byte[8];

View on GitHub (pinned to 53fb989abc)

Solutions

  1. Pass a digest byte size between 1 and 32; remember this constructor takes BYTES, not bits (use 32 for a 256-bit hash).
  2. If you need a longer digest, use Blake2bDigest (up to 64 bytes) or a different algorithm.
  3. Clamp or validate user/config-supplied digest sizes before constructing the digest.

Example fix

// before
var digest = new Blake2sDigest(null, 256, null, null); // bits passed by mistake
// after
var digest = new Blake2sDigest(null, 32, null, null); // 32 bytes = 256 bits
Defensive patterns

Strategy: validation

Validate before calling

if (digestBytes < 1 || digestBytes > 32)
    throw new ArgumentOutOfRangeException(nameof(digestBytes), "Blake2s digest must be 1-32 bytes");
var digest = new Blake2sDigest(key, digestBytes, salt, personalization);

Type guard

static bool IsValidDigestBytes(int n) => n >= 1 && n <= 32;

Try / catch

try { var d = new Blake2sDigest(key, digestBytes, salt, pers); }
catch (ArgumentException ex) { /* clamp to 32 or surface config error */ }

Prevention

When it happens

Trigger: Calling new Blake2sDigest(key, digestBytes, salt, personalization) with digestBytes < 1 or digestBytes > 32 — e.g. passing 64 to mirror a Blake2b/SHA-512 output size, or passing 0/-1 by accident.

Common situations: Porting code from Blake2b (up to 64 bytes) or SHA-256 configs where a bit size (256) was passed instead of a byte size (32); config-driven digest sizes; off-by-one when computing output length.

Related errors

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/53bca174cc2d484d. Report an issue: GitHub.