peass-ng/PEASS-ng · error · ArgumentException

not supported for SHA-3

Error message

 not supported for SHA-3

What it means

Sha3Digest.CheckBitLength throws ArgumentException when the constructor's bitLength is not one of the SHA-3 approved sizes: 224, 256, 384, or 512. The check validates the fixed output-size variants of SHA-3; other Keccak rates must use KeccakDigest directly. Raised from the Sha3Digest constructor.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/SHA3Digest.cs:26

    /// Implementation of SHA-3 based on following KeccakNISTInterface.c from http://keccak.noekeon.org/
    /// </summary>
    /// <remarks>
    /// Following the naming conventions used in the C source code to enable easy review of the implementation.
    /// </remarks>
    public class Sha3Digest
        : KeccakDigest
    {
        private static int CheckBitLength(int bitLength)
        {
            switch (bitLength)
            {
            case 224:
            case 256:
            case 384:
            case 512:
                return bitLength;
            default:
                throw new ArgumentException(bitLength + " not supported for SHA-3", "bitLength");
            }
        }

        public Sha3Digest()
            : this(256)
        {
        }

        public Sha3Digest(int bitLength)
            : base(CheckBitLength(bitLength))
        {
        }

        public Sha3Digest(Sha3Digest source)
            : base(source)
        {
        }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Use one of the supported values: 224, 256, 384, or 512.
2. For non-standard rates, instantiate KeccakDigest directly instead of Sha3Digest.
3. Validate/normalize configured bit length before constructing the digest.

Example fix

// before
var digest = new Sha3Digest(288); // throws
// after
var digest = new Sha3Digest(256); // valid SHA-3 size
// or for non-standard rates:
var keccak = new KeccakDigest(288);

static readonly int[] ValidSha3Sizes = { 224, 256, 384, 512 };
if (!ValidSha3Sizes.Contains(bitLength))
    throw new ArgumentOutOfRangeException(nameof(bitLength), $"{bitLength} not supported for SHA-3; use 224/256/384/512");
var digest = new Sha3Digest(bitLength);

bool IsSha3Size(int bitLength) => bitLength is 224 or 256 or 384 or 512;

try { digest = new Sha3Digest(bitLength); } catch (ArgumentException ex) when (ex.ParamName == "bitLength") { digest = new Sha3Digest(256); // safe default }

When it happens

Trigger: Calling `new Sha3Digest(bitLength)` with values like 128, 288, or a raw Keccak rate (e.g. 576, 1024).

Common situations: Confusing SHA-3 sizes with original Keccak sizes (Keccak supports 224/256/288/384/512 and arbitrary rates); deriving bit length from config without validation.

Related errors

• must be in the range [0,7]
• BLAKE2b digest bit length must be a multiple of 8 and not gr
• Invalid digest length (required: 1 - 64)
• BLAKE2s digest bit length must be a multiple of 8 and not gr
• must be in the range 1 to 7

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/95f3dcf4c3152828. Report an issue: GitHub.