peass-ng/PEASS-ng · error · ArgumentException

Keys > 64 are not supported

Error message

Keys > 64 are not supported

What it means

BLAKE2b supports keyed hashing (MAC mode) with keys up to 64 bytes; this constructor overload rejects any longer key with an ArgumentException, thrown after the key has already been copied. The check enforces the BLAKE2b spec's 64-byte key limit.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2bDigest.cs:164

        /**
         * Blake2b for authentication ("Prefix-MAC mode").
         * After calling the doFinal() method, the key will
         * remain to be used for further computations of
         * this instance.
         * The key can be overwritten using the clearKey() method.
         *
         * @param key A key up to 64 bytes or null
         */
        public Blake2bDigest(byte[] key)
        {
            buffer = new byte[BLOCK_LENGTH_BYTES];
            if (key != null)
            {
                this.key = new byte[key.Length];
                Array.Copy(key, 0, this.key, 0, key.Length);

                if (key.Length > 64)
                    throw new ArgumentException("Keys > 64 are not supported");

                keyLength = key.Length;
                Array.Copy(key, 0, buffer, 0, key.Length);
                bufferPos = BLOCK_LENGTH_BYTES; // zero padding
            }
            digestLength = 64;
            Init();
        }

        /**
         * Blake2b with key, required digest length (in bytes), salt and personalization.
         * After calling the doFinal() method, the key, the salt and the personal string
         * will remain and might be used for further computations with this instance.
         * The key can be overwritten using the clearKey() method, the salt (pepper)
         * can be overwritten using the clearSalt() method.
         *
         * @param key             A key up to 64 bytes or null
         * @param digestLength    from 1 up to 64 bytes

View on GitHub (pinned to 53fb989abc)

Solutions

1. Truncate or derive the key to <= 64 bytes (e.g. hash the long key first and use its digest as the BLAKE2b key)
2. Use the full constructor Blake2bDigest(key, digestLength, salt, personalization) after validating key length
3. Regenerate the key with the correct 64-byte maximum length

Example fix

// before
var d = new Blake2bDigest(longKey); // longKey.Length = 128
// after
if (longKey.Length > 64)
    longKey = new Sha512Digest(); /* derive via hash */ ;
var d = new Blake2bDigest(TruncateTo64(longKey));

bool IsValidBlake2bKey(byte[] key) => key == null || key.Length <= 64;

try { var d = new Blake2bDigest(key); }
catch (ArgumentException ex) when (ex.Message.Contains("Keys > 64")) {
    key = DeriveKey64(key); var d = new Blake2bDigest(key);
}

When it happens

Trigger: new Blake2bDigest(byte[] key) where key.Length > 64.

Common situations: Using 128-byte HMAC-style keys with BLAKE2b, generating keys with wrong parameters, concatenating secret material into an oversized key.

Related errors

• BLAKE2b digest bit length must be a multiple of 8 and not gr
• Invalid digest length (required: 1 - 64)
• salt length must be exactly 16 bytes
• personalization length must be exactly 16 bytes
• data

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/cdf09179b3d73e09. Report an issue: GitHub.