{"record":{"id":"29529f36efbb93e8","repo":"phalcon/cphalcon","slug":"cannot-calculate-the-initialization-vector-iv-le","errorCode":null,"errorMessage":"Cannot calculate the initialization vector (IV) length of the cipher","messagePattern":"Cannot calculate the initialization vector \\(IV\\) length of the cipher","errorType":"exception","errorClass":"IvLengthCalculationFailed","httpStatus":null,"severity":"error","filePath":"phalcon/Encryption/Crypt.zep","lineNumber":1014,"sourceCode":"            str_ireplace(\"-\" . mode, \"\", this->cipher)\n        );\n    }\n\n    /**\n     * Initialize available cipher algorithms.\n     *\n     * @param string $cipher\n     *\n     * @return int\n     * @throws Exception\n     */\n    private function getIvLength(string cipher) -> int\n    {\n        var length;\n\n        let length = openssl_cipher_iv_length(cipher);\n        if false === length {\n            throw new IvLengthCalculationFailed();\n        }\n\n        return length;\n    }\n\n    /**\n     * Returns the mode (last few characters of the cipher)\n     *\n     * @return string\n     */\n    private function getMode() -> string\n    {\n        var position;\n        let position = intval(strrpos(this->cipher, \"-\"));\n\n        return mb_strtolower(\n            substr(this->cipher, position - strlen(this->cipher) + 1)\n        );","sourceCodeStart":996,"sourceCodeEnd":1032,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Encryption/Crypt.zep#L996-L1032","documentation":"Crypt::setCipher() computes the IV length via openssl_cipher_iv_length(); if OpenSSL returns false for the cipher it throws IvLengthCalculationFailed('Cannot calculate the initialization vector (IV) length of the cipher'). This happens after the availability check, so it signals a cipher OpenSSL lists but cannot report an IV for - an inconsistency between the method list and the IV API, or an AEAD/odd cipher edge on the local OpenSSL build.","triggerScenarios":"setCipher($name) where openssl_get_cipher_methods(true) contains the lowercased name but openssl_cipher_iv_length($name) returns false - observed with certain OpenSSL builds and unusual/legacy cipher identifiers; effectively a defensive check for OpenSSL-level inconsistency rather than a routine validation error.","commonSituations":"Rare; usually surfaces when scripting cipher selection dynamically (iterating openssl_get_cipher_methods and feeding every entry to setCipher), or on exotic/older libssl builds where the two OpenSSL APIs disagree.","solutions":["Pre-filter candidate ciphers yourself: if (openssl_cipher_iv_length($cipher) === false) continue; when auto-selecting a cipher.","Standardize on aes-256-cbc / aes-256-gcm which behave consistently across supported OpenSSL versions.","If a specific cipher keeps failing on one host, the libssl build is the suspect - align or upgrade the OpenSSL/php-openssl packages on that machine."],"exampleFix":"// before\nforeach (openssl_get_cipher_methods(true) as $candidate) {\n    $crypt->setCipher($candidate); // some entries -> IvLengthCalculationFailed\n}\n\n// after\nforeach (openssl_get_cipher_methods(true) as $candidate) {\n    if (false !== openssl_cipher_iv_length($candidate)) {\n        $crypt->setCipher($candidate);\n        break;\n    }\n}","handlingStrategy":"validation","validationCode":"if (false === openssl_cipher_iv_length($cipher)) {\n    throw new \\RuntimeException(\"OpenSSL cannot report an IV length for '{$cipher}' - pick another cipher\");\n}\n$crypt->setCipher($cipher);","typeGuard":"function hasResolvableIvLength(string $cipher): bool\n{\n    return false !== openssl_cipher_iv_length($cipher);\n}","tryCatchPattern":"try {\n    $crypt->setCipher($candidate);\n} catch (\\Phalcon\\Encryption\\Crypt\\Exception\\IvLengthCalculationFailed $e) {\n    continue; // iterate to the next candidate when auto-selecting ciphers\n}","preventionTips":["When auto-selecting ciphers, filter with openssl_cipher_iv_length() before calling setCipher().","Pin standard ciphers (aes-256-cbc/gcm) in config instead of discovering dynamically.","Align OpenSSL/libssl versions across hosts so the cipher and IV APIs agree."],"tags":["phalcon","crypt","openssl","cipher","iv"],"backgroundTag":"unsupported-cipher-algorithm","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}