{"record":{"id":"12d42fb6149b2b3b","repo":"gchq/CyberChef","slug":"err-12d42f","errorCode":null,"errorMessage":"${err}","messagePattern":"\\$\\{err\\}","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/GOSTKeyUnwrap.mjs","lineNumber":136,"sourceCode":"            length: blockLength,\n            mode: \"KW\",\n            sBox: sBoxVal,\n            keyWrapping: keyWrapping\n        };\n\n        try {\n            const Hex = CryptoGost.coding.Hex;\n            algorithm.ukm = Hex.decode(ukm);\n\n            const cipher = GostEngine.getGostCipher(algorithm);\n            const out = Hex.encode(cipher.unwrapKey(Hex.decode(key), Hex.decode(input)));\n\n            return outputType === \"Hex\" ? out : Utils.byteArrayToChars(fromHex(out));\n        } catch (err) {\n            if (err.toString().includes(\"Invalid typed array length\")) {\n                throw new OperationError(\"Incorrect input length. Must be a multiple of the block size.\");\n            }\n            throw new OperationError(err);\n        }\n    }\n\n}\n\nexport default GOSTKeyUnwrap;\n","sourceCodeStart":118,"sourceCodeEnd":143,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/GOSTKeyUnwrap.mjs#L118-L143","documentation":"The fallback re-throw in GOST Key Unwrap's try/catch: any crypto-gost-js error whose message does NOT contain \"Invalid typed array length\" is wrapped here. Covers bad hex in key/ukm/input, a KEK that isn't 256 bits, an unsupported keyWrapping scheme, or engine construction failures.","triggerScenarios":"Key (KEK) not 32 bytes; UKM hex invalid or wrong length; non-hex characters in input; a keyWrapping value the library rejects; algorithm/version internal inconsistency.","commonSituations":"Pasting a base64 KEK into a Hex field; UKM of wrong length for the wrapping mode; interop with tooling using a non-default keyWrapping diversity type.","solutions":["Provide a 32-byte (64-hex) KEK.","Decode UKM to the length the wrapping scheme expects.","Ensure all hex fields contain only hex digits.","Inspect the preserved `err` for the library's exact message."],"exampleFix":"// before\nkey = \"aabb\"; // KEK too short\nukm = \"zz\"; // not hex\n// after\nkey = \"aabb...\".padEnd(64,\"0\"); // 32-byte KEK\nukm = \"00112233445566778899aabbccddeeff\";","handlingStrategy":"try-catch","validationCode":"if (hexKey.length !== 64) throw new Error(\"KEK must be 32 bytes / 64 hex chars\");\nif (!/^[0-9a-fA-F]*$/.test(ukm) || ukm.length % 2 !== 0) throw new Error(\"UKM must be valid hex\");","typeGuard":"function isHex(s){return typeof s===\"string\"&&/^[0-9a-fA-F]*$/.test(s)&&s.length%2===0;}","tryCatchPattern":"try { chef.bake(input, recipe); }\ncatch (e) { if (/hex|key|ukm|length/i.test(e.message||\"\")) handleUserError(e); else throw e; }","preventionTips":["Provide a 32-byte KEK.\n","Decode UKM to the length the wrapping scheme expects.\n","Keep only hex digits in hex fields.\n","Inspect the wrapped err for the library's message."],"tags":["crypto","gost","key-wrap","input-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}