{"record":{"id":"1274edc5c318fcca","repo":"Blankj/AndroidUtilCode","slug":"key-must-be-between-1-and-256-bytes","errorCode":null,"errorMessage":"key must be between 1 and 256 bytes","messagePattern":"key must be between 1 and 256 bytes","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"lib/utilcode/src/main/java/com/blankj/utilcode/util/EncryptUtils.java","lineNumber":1145,"sourceCode":"            } else {\n                return cipher.doFinal(data);\n            }\n        } catch (Exception e) {\n            e.printStackTrace();\n        }\n        return null;\n    }\n\n    /**\n     * Return the bytes of RC4 encryption/decryption.\n     *\n     * @param data The data.\n     * @param key  The key.\n     */\n    public static byte[] rc4(byte[] data, byte[] key) {\n        if (data == null || data.length == 0 || key == null) return null;\n        if (key.length < 1 || key.length > 256) {\n            throw new IllegalArgumentException(\"key must be between 1 and 256 bytes\");\n        }\n        final byte[] iS = new byte[256];\n        final byte[] iK = new byte[256];\n        int keyLen = key.length;\n        for (int i = 0; i < 256; i++) {\n            iS[i] = (byte) i;\n            iK[i] = key[i % keyLen];\n        }\n        int j = 0;\n        byte tmp;\n        for (int i = 0; i < 256; i++) {\n            j = (j + iS[i] + iK[i]) & 0xFF;\n            tmp = iS[j];\n            iS[j] = iS[i];\n            iS[i] = tmp;\n        }\n\n        final byte[] ret = new byte[data.length];","sourceCodeStart":1127,"sourceCodeEnd":1163,"githubUrl":"https://github.com/Blankj/AndroidUtilCode/blob/7b4caf9e5440046b3fefb63b6b6e2ead7ebaf809/lib/utilcode/src/main/java/com/blankj/utilcode/util/EncryptUtils.java#L1127-L1163","documentation":"EncryptUtils.rc4(byte[], byte[]) implements the RC4 stream cipher, which initialises a 256-byte S-box keyed by repeating the supplied key. The RC4 specification requires a key of 1..256 bytes; a zero-length or over-long key would either divide-by-zero (keyLen=0 in key[i % keyLen]) or break the cipher's security assumptions, so the method fails fast with IllegalArgumentException. Note: a null key returns null earlier, and null/empty data also returns null.","triggerScenarios":"Passing a key byte[] of length 0 (e.g. from an empty password or a config that yielded no bytes) or longer than 256 bytes (e.g. a raw RSA/HMAC key, a full certificate, or concatenated secrets). Decryption fails symmetrically because RC4 uses the same routine for both directions.","commonSituations":"Deriving the RC4 key from user input that was left empty; using a hex/Base64 string as the key without decoding; concatenating multiple key materials past the 256-byte ceiling; migrating from a 'no key check' RC4 implementation that silently accepted any length.","solutions":["Ensure the key is a properly derived 16/32-byte (or other 1..256) secret — e.g. feed a passphrase through a KDF (PBKDF2/HKDF) before calling rc4.","Validate the key length at the boundary: if (key == null || key.length == 0 || key.length > 256) reject/derive before calling.","If the key is hex/Base64-encoded text, decode it to bytes first (ConvertUtils.hexString2Bytes / Base64.decode) rather than passing getBytes().","Avoid RC4 entirely for new code (it is cryptographically broken); prefer EncryptUtils.encryptAES(...) and use RC4 only for legacy interop with a known-correct key."],"exampleFix":"// before\nbyte[] out = EncryptUtils.rc4(data, passphrase.getBytes()); // empty/over-long passphrase\n\n// after\nbyte[] key = deriveKey(passphrase); // PBKDF2/HKDF -> 16..256 bytes\nbyte[] out = EncryptUtils.rc4(data, key);","handlingStrategy":"validation","validationCode":"// Validate the RC4 key length before calling\nbyte[] key = derivedKey;\nif (key == null || key.length == 0 || key.length > 256) {\n    // derive a proper key (e.g. via PBKDF2/HKDF) instead of throwing\n    key = deriveKey(passphrase, 16);\n}\nbyte[] out = EncryptUtils.rc4(data, key);","typeGuard":"// RC4 key length guard\npublic static boolean isValidRc4Key(byte[] key) {\n    return key != null && key.length >= 1 && key.length <= 256;\n}","tryCatchPattern":"try {\n    byte[] out = EncryptUtils.rc4(data, key);\n} catch (IllegalArgumentException e) {\n    // key length out of range; derive a valid key and retry\n    byte[] fixed = deriveKey(passphrase, 16);\n    out = EncryptUtils.rc4(data, fixed);\n}","preventionTips":["Derive the RC4 key from a passphrase via PBKDF2/HKDF into a fixed 16/32-byte secret.","If the key is hex/Base64 text, decode to bytes before calling rc4 — don't pass getBytes().","RC4 is cryptographically broken; prefer EncryptUtils.encryptAES(...) for new code.","Check key length 1..256 at the boundary where keys enter your code."],"tags":["crypto","encrypt","validation","argument-check","rc4"],"backgroundTag":null,"analyzedSha":"7b4caf9e5440046b3fefb63b6b6e2ead7ebaf809","analyzedAt":"2026-08-14T02:26:54.956Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}