You’re allowed 32 bytes as a subaccount identifier, this is all zeros for the default account. It gets appended to the principal before hashing to derive the account id.
Some details here:
https://github.com/dfinity/ic/blob/master/rs/rosetta-api/docs/modules/rosetta-api/pages/ledger.adoc#accounts
And here:
https://fxa77-fiaaa-aaaae-aaana-cai.raw.ic0.app/wrongzoo