peass-ng/PEASS-ng · error · ArgumentException

invalid S-box passed to GOST28147 init

Error message

invalid S-box passed to GOST28147 init

What it means

Gost28147Engine.Init throws this ArgumentException when a ParametersWithSBox carries an S-box byte[] whose length differs from the default (8x16 = 128 bytes expected). GOST 28147 substitution blocks must have the same size as the built-in default table.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/engines/Gost28147Engine.cs:165

		*
		* @param forEncryption whether or not we are for encryption.
		* @param parameters the parameters required to set up the cipher.
		* @exception ArgumentException if the parameters argument is inappropriate.
		*/
		public virtual void Init(
			bool forEncryption,
			ICipherParameters parameters)
		{
			if (parameters is ParametersWithSBox)
			{
				ParametersWithSBox param = (ParametersWithSBox)parameters;

				//
				// Set the S-Box
				//
				byte[] sBox = param.GetSBox();
				if (sBox.Length != Sbox_Default.Length)
					throw new ArgumentException("invalid S-box passed to GOST28147 init");

				this.S = Arrays.Clone(sBox);

				//
				// set key if there is one
				//
				if (param.Parameters != null)
				{
					workingKey = generateWorkingKey(forEncryption,
							((KeyParameter)param.Parameters).GetKey());
				}
			}
			else if (parameters is KeyParameter)
			{
				workingKey = generateWorkingKey(forEncryption,
									((KeyParameter)parameters).GetKey());
			}
			else if (parameters != null)

View on GitHub (pinned to 53fb989abc)

Solutions

1. Supply a complete 128-byte S-box (8 substitution rows of 16 bytes)
2. Verify the S-box source encoding (hex/base64) and strip any framing
3. If unsure, omit the S-box parameter to use the library default

Example fix

// before
byte[] sBox = File.ReadAllBytes("sbox.bin"); // wrong length
engine.Init(forEncryption, new ParametersWithSBox(new KeyParameter(key), sBox));
// after
if (sBox.Length != 128) throw new InvalidOperationException("bad sbox");
engine.Init(forEncryption, new ParametersWithSBox(new KeyParameter(key), sBox));

if (sBox == null || sBox.Length != 128) throw new ArgumentException("GOST S-box must be 128 bytes");

static bool IsValidGostSBox(byte[] sBox) => sBox != null && sBox.Length == 128;

try { engine.Init(forEncryption, new ParametersWithSBox(new KeyParameter(key), sBox)); } catch (ArgumentException ex) { /* fall back to default S-box */ }

When it happens

Trigger: Calling Init with ParametersWithSBox containing a truncated, corrupted, or wrongly-encoded S-box byte[] whose length != Sbox_Default.Length.

Common situations: Loading an S-box from a file that includes headers or a different byte order, hand-typed S-box strings decoded incorrectly, or a custom S-box in a non-128-byte representation.

Related errors

• Keys > 32 are not supported
• Invalid digest length (required: 1 - 32)
• Salt length must be exactly 8 bytes
• Personalization length must be exactly 8 bytes
• Keys > 32 bytes are not supported

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/33c1eabedf7a318e. Report an issue: GitHub.