{"record":{"id":"45987bc06686c5ff","repo":"gchq/CyberChef","slug":"the-key-for-aes-must-be-either-16-24-or-32-bytes","errorCode":null,"errorMessage":"The key for AES must be either 16, 24, or 32 bytes (currently ${key.length} bytes)","messagePattern":"The key for AES must be either 16, 24, or 32 bytes \\(currently (.+?) bytes\\)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/CMAC.mjs","lineNumber":58,"sourceCode":"                \"value\": [\"AES\", \"Triple DES\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {ArrayBuffer} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option);\n        const algo = args[1];\n\n        const info = (function() {\n            switch (algo) {\n                case \"AES\":\n                    if (key.length !== 16 && key.length !== 24 && key.length !== 32) {\n                        throw new OperationError(\"The key for AES must be either 16, 24, or 32 bytes (currently \" + key.length + \" bytes)\");\n                    }\n                    return {\n                        \"algorithm\": \"AES-ECB\",\n                        \"key\": key,\n                        \"blockSize\": 16,\n                        \"Rb\": new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x87]),\n                    };\n                case \"Triple DES\":\n                    if (key.length !== 16 && key.length !== 24) {\n                        throw new OperationError(\"The key for Triple DES must be 16 or 24 bytes (currently \" + key.length + \" bytes)\");\n                    }\n                    return {\n                        \"algorithm\": \"3DES-ECB\",\n                        \"key\": key.length === 16 ? key + key.substring(0, 8) : key,\n                        \"blockSize\": 8,\n                        \"Rb\": new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0x1b]),\n                    };\n                default:","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/CMAC.mjs#L40-L76","documentation":"CMAC over AES uses an AES block cipher whose key must be 128, 192, or 256 bits (16, 24, or 32 bytes). The operation throws when the key length is none of these, because AES-ECB used to derive the CMAC subkeys would reject it.","triggerScenarios":"Calling CMAC.run with algo='AES' and a key whose byte length is not 16, 24, or 32.","commonSituations":"Using a passphrase directly instead of a sized key; wrong key encoding option (hex text read as UTF-8 doubles length); trailing newline in key.","solutions":["Provide a 16, 24, or 32 byte AES key.","Confirm args[0].option matches the key encoding.","Derive the key with a KDF (e.g. HKDF) to the required length."],"exampleFix":"// before\nkey option 'UTF8' with 'short'\n// after\nkey option 'Hex' with '000102030405060708090a0b0c0d0e0f'","handlingStrategy":"validation","validationCode":"const keyBytes = Utils.convertToByteString(args[0].string, args[0].option);\nif (![16, 24, 32].includes(keyBytes.length)) throw new Error('AES-CMAC key must be 16/24/32 bytes');","typeGuard":"function isAesKeyLen(len) { return [16, 24, 32].includes(len); }","tryCatchPattern":null,"preventionTips":["Derive keys to exactly 16, 24, or 32 bytes.","Confirm the key encoding option.","Avoid raw passphrases as keys."],"tags":["crypto","cmac","aes","key-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}