{"record":{"id":"02329c02b51b195d","repo":"gchq/CyberChef","slug":"invalid-block-cipher-mode-mode-02329c","errorCode":null,"errorMessage":"Invalid block cipher mode: ${mode}","messagePattern":"Invalid block cipher mode: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/TEA.mjs","lineNumber":338,"sourceCode":"                cipherText.push(...xorBlocks(ivBlock, block));\n            }\n            return cipherText.slice(0, messageLength);\n        }\n\n        case \"CTR\": {\n            let counter = [...iv];\n            for (let i = 0; i < data.length; i += BLOCK_SIZE) {\n                const encrypted = encryptBlockFn(counter, key);\n                const block = data.slice(i, i + BLOCK_SIZE);\n                while (block.length < BLOCK_SIZE) block.push(0);\n                cipherText.push(...xorBlocks(encrypted, block));\n                counter = incrementCounter(counter);\n            }\n            return cipherText.slice(0, messageLength);\n        }\n\n        default:\n            throw new OperationError(`Invalid block cipher mode: ${mode}`);\n    }\n\n    return cipherText;\n}\n\n/**\n * Decrypt with block cipher modes\n *\n * @param {number[]} cipherText - Ciphertext bytes\n * @param {number[]} key - 16-byte key\n * @param {number[]} iv - 8-byte IV (ignored for ECB)\n * @param {string} mode - \"ECB\", \"CBC\", \"CFB\", \"OFB\", \"CTR\"\n * @param {string} padding - \"PKCS5\", \"NO\", \"ZERO\", \"RANDOM\", \"BIT\"\n * @param {Function} encryptBlockFn - Block encrypt function (used for stream modes)\n * @param {Function} decryptBlockFn - Block decrypt function (used for ECB/CBC)\n * @returns {number[]} - Plaintext bytes\n */\nfunction decryptWithMode(cipherText, key, iv, mode, padding, encryptBlockFn, decryptBlockFn) {","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/TEA.mjs#L320-L356","documentation":"Thrown by the internal encryptWithMode() helper in TEA.mjs when the `mode` argument does not match any of the handled cases (ECB, CBC, CFB, OFB, CTR). The function dispatches on a switch statement and falls into a `default` branch that rejects unknown modes. It surfaces a programmer/config error: the cipher core itself only supports those five block modes.","triggerScenarios":"Calling encryptTEA()/encryptXTEA() with a mode string other than \"ECB\", \"CBC\", \"CFB\", \"OFB\", or \"CTR\". Common triggers: passing a lowercase variant (\"ecb\", \"Cbc\"), a typo (\"CBC \" with trailing space, \"CCB\"), or a mode the library does not implement (e.g. \"GCM\", \"PCBC\", \"OFB8\"). Also triggered by passing undefined/null which becomes the literal \"undefined\" string.","commonSituations":"Config/UI dropdown value mismatches after a refactor; copy-pasting a mode constant from another cipher library (Node crypto uses 'aes-128-cbc'); user-typed recipe input in CyberChef that is not whitelisted by the operation's option list; migration from an older API that accepted different mode names.","solutions":["Pass one of the exactly-cased supported modes: \"ECB\", \"CBC\", \"CFB\", \"OFB\", or \"CTR\" (uppercase, no whitespace).","If the value comes from user/UI input, normalise it first: mode.trim().toUpperCase(), then validate against a whitelist before calling encryptTEA/encryptXTEA.","If you need a mode like GCM/CCM, it is not supported by this library — pick a different cipher implementation or use CTR/CBC instead."],"exampleFix":"// before\nencryptTEA(msg, key, iv, \"cbc\", \"PKCS5\");\n// after\nencryptTEA(msg, key, iv, \"CBC\", \"PKCS5\");","handlingStrategy":"validation","validationCode":"const TEA_MODES = [\"ECB\", \"CBC\", \"CFB\", \"OFB\", \"CTR\"];\nconst safeMode = String(mode ?? \"\").trim().toUpperCase();\nif (!TEA_MODES.includes(safeMode)) {\n    throw new Error(`Unsupported TEA mode: '${mode}'. Use one of ${TEA_MODES.join(\", \")}`);\n}\nencryptTEA(msg, key, iv, safeMode, padding);","typeGuard":"function isTeaMode(m) {\n    return typeof m === \"string\" &&\n        [\"ECB\", \"CBC\", \"CFB\", \"OFB\", \"CTR\"].includes(m);\n}","tryCatchPattern":"try {\n    cipherText = encryptTEA(msg, key, iv, mode, padding);\n} catch (e) {\n    if (e instanceof OperationError && /Invalid block cipher mode/.test(e.message)) {\n        // surface a config-level error to the user\n        return { error: `Cipher mode '${mode}' is not supported by TEA.` };\n    }\n    throw e;\n}","preventionTips":["Centralise mode constants in one module and import them everywhere rather than typing strings.","Whitelist and normalise (trim+toUpperCase) any mode that originates from user input or config before it reaches the cipher.","When encrypt and decrypt live in different code paths, share one constant for the mode so they cannot drift."],"tags":["crypto","tea","block-cipher-mode","argument-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}