peass-ng/PEASS-ng · error · ArgumentException

salt length must be exactly 16 bytes

Error message

salt length must be exactly 16 bytes

What it means

The Blake2bDigest parameterized constructor throws ArgumentException when the digestLength parameter falls outside the 1-64 byte range allowed by BLAKE-2b; it fires in the constructor's validation guard before the salt check, so the faulting input is an out-of-range digestLength (not the salt, despite the salt wording in nearby docs).

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/crypto/digests/Blake2bDigest.cs:197

         * can be overwritten using the clearSalt() method.
         *
         * @param key             A key up to 64 bytes or null
         * @param digestLength    from 1 up to 64 bytes
         * @param salt            16 bytes or null
         * @param personalization 16 bytes or null
         */
        public Blake2bDigest(byte[] key, int digestLength, byte[] salt, byte[] personalization)
        {
            if (digestLength < 1 || digestLength > 64)
                throw new ArgumentException("Invalid digest length (required: 1 - 64)");

            this.digestLength = digestLength;
            this.buffer = new byte[BLOCK_LENGTH_BYTES];

            if (salt != null)
            {
                if (salt.Length != 16)
                    throw new ArgumentException("salt length must be exactly 16 bytes");

                this.salt = new byte[16];
                Array.Copy(salt, 0, this.salt, 0, salt.Length);
            }
            if (personalization != null)
            {
                if (personalization.Length != 16)
                    throw new ArgumentException("personalization length must be exactly 16 bytes");

                this.personalization = new byte[16];
                Array.Copy(personalization, 0, this.personalization, 0, personalization.Length);
            }
            if (key != null)
            {
                if (key.Length > 64)
                    throw new ArgumentException("Keys > 64 are not supported");

                this.key = new byte[key.Length];

View on GitHub (pinned to 53fb989abc)

Solutions

1. Ensure the salt is exactly 16 bytes (zero-pad shorter salts, truncate longer ones)
2. Pass null instead of an empty or wrong-size array when salt is not used
3. Generate salts with a fixed 16-byte size

Example fix

// before
var d = new Blake2bDigest(key, 64, Encoding.UTF8.GetBytes("mysalt"), null);
// after
byte[] salt = new byte[16];
Array.Copy(Encoding.UTF8.GetBytes("mysalt"), salt, Math.Min(6, 16));
var d = new Blake2bDigest(key, 64, salt, null);

byte[] NormalizeSalt(byte[] salt) {
    if (salt == null) return null;
    if (salt.Length == 16) return salt;
    var s = new byte[16];
    Array.Copy(salt, s, Math.Min(salt.Length, 16));
    return s;
}

When it happens

Trigger: new Blake2bDigest(key, digestLength, salt, personalization) where salt != null and salt.Length != 16.

Common situations: Using 8- or 32-byte salts from other algorithms, passing an empty array instead of null when no salt is wanted, truncating/deriving salts incorrectly.

Related errors

• BLAKE2b digest bit length must be a multiple of 8 and not gr
• Keys > 64 are not supported
• Invalid digest length (required: 1 - 64)
• personalization length must be exactly 16 bytes
• data

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/9e00199e479f1436. Report an issue: GitHub.