peass-ng/PEASS-ng · error · ArgumentException

IV must be at least 1 byte

Error message

IV must be at least 1 byte

What it means

A nonce validation in GcmBlockCipher.Init: after extracting the nonce from AeadParameters or ParametersWithIV it must be non-null and at least one byte long, because GCM derives its counter block from the IV and an empty IV is undefined. It fires when the caller passes an empty or missing nonce array.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/modes/GcmBlockCipher.cs:131

            {
                ParametersWithIV param = (ParametersWithIV)parameters;

                newNonce = param.GetIV();
                initialAssociatedText = null;
                macSize = 16;
                keyParam = (KeyParameter)param.Parameters;
            }
            else
            {
                throw new ArgumentException("invalid parameters passed to GCM");
            }

            int bufLength = forEncryption ? BlockSize : (BlockSize + macSize);
            this.bufBlock = new byte[bufLength];

            if (newNonce == null || newNonce.Length < 1)
            {
                throw new ArgumentException("IV must be at least 1 byte");
            }

            if (forEncryption)
            {
                if (nonce != null && Arrays.AreEqual(nonce, newNonce))
                {
                    if (keyParam == null)
                    {
                        throw new ArgumentException("cannot reuse nonce for GCM encryption");
                    }
                    if (lastKey != null && Arrays.AreEqual(lastKey, keyParam.GetKey()))
                    {
                        throw new ArgumentException("cannot reuse nonce for GCM encryption");
                    }
                }
            }

            nonce = newNonce;

View on GitHub (pinned to 53fb989abc)

Solutions

1. Generate a 12-byte random nonce per encryption and pass it in ParametersWithIV/AeadParameters
2. Reject empty IVs at the call site before initializing the cipher
3. Never reuse a nonce with the same key; derive/store the nonce alongside the ciphertext

When it happens

Trigger: Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/modes/GcmBlockCipher.cs:131 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/956803dd782ebc95. Report an issue: GitHub.