peass-ng/PEASS-ng · error · ArgumentException

Key length invalid. Key needs to be 32 byte - 256 bit!!!

Error message

Key length invalid. Key needs to be 32 byte - 256 bit!!!

What it means

Gost28147Engine.Init throws this ArgumentException when the supplied key byte array is not exactly 32 bytes (256 bits). The GOST 28147-89 cipher is defined only for 256-bit keys; generateWorkingKey converts the user key into 8 32-bit subkey words and cannot process any other length.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/engines/Gost28147Engine.cs:234

			Gost28147Func(workingKey, input, inOff, output, outOff);

			return BlockSize;
		}

		public virtual void Reset()
		{
		}

		private int[] generateWorkingKey(
			bool forEncryption,
			byte[] userKey)
		{
			this.forEncryption = forEncryption;

			if (userKey.Length != 32)
			{
				throw new ArgumentException("Key length invalid. Key needs to be 32 byte - 256 bit!!!");
			}

			int[] key = new int[8];
			for (int i = 0; i != 8; i++)
			{
				key[i] = bytesToint(userKey, i * 4);
			}

			return key;
		}

		private int Gost28147_mainStep(int n1, int key)
		{
			int cm = (key + n1); // CM1

			// S-box replacing

			int om = S[0 + ((cm >> (0 * 4)) & 0xF)] << (0 * 4);

View on GitHub (pinned to 53fb989abc)

Solutions

1. Generate or supply a key of exactly 32 bytes (256 bits) before calling Init
2. Derive a 32-byte key from arbitrary input with a KDF such as SHA-256 or PBKDF2 instead of truncating/padding
3. Check the decoding path (hex/base64) of the key material — a wrong decode commonly yields a shorter array

Example fix

// before
byte[] key = Encoding.UTF8.GetBytes("my-password");
engine.Init(true, new KeyParameter(key));
// after
byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes("my-password"));
engine.Init(true, new KeyParameter(key));

if (key == null || key.Length != 32) throw new ArgumentException("GOST key must be exactly 32 bytes");
engine.Init(forEncryption, new KeyParameter(key));

bool IsValidGostKey(byte[] key) => key != null && key.Length == 32;

try { engine.Init(forEncryption, new KeyParameter(key)); }
catch (ArgumentException ex) { /* log ex.Message; reject key material */ }

When it happens

Trigger: Calling Gost28147Engine.Init with a KeyParameter whose key byte[] length differs from 32 (e.g. a 16-byte AES key, 24-byte key, or an empty/nil key).

Common situations: Reusing key material generated for AES (128/192-bit) or DES (56/64-bit) with GOST; truncating or concatenating keys from config; decoding a base64/hex key that yields the wrong number of bytes.

Related errors

• invalid S-box passed to GOST28147 init
• invalid parameter passed to Gost28147 init -
• Gost28147 engine not initialised
• Unknown S-Box - possible types: "Default", "E-Test", "E-A",
• SBOX provided did not map to a known one

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/d5d5316836e2741f. Report an issue: GitHub.