{"record":{"id":"4b30ea4649a12f17","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-ascon-ae-4b30ea","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes.\n\nAscon-AEAD128 requires a key of exactly 16 bytes (128 bits).","messagePattern":"Invalid key length: (.+?) bytes\\.\n\nAscon-AEAD128 requires a key of exactly 16 bytes \\(128 bits\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AsconEncrypt.mjs","lineNumber":76,"sourceCode":"            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     * @throws {OperationError} if invalid key or nonce length\n     */\n    run(input, args) {\n        const key = Utils.convertToByteArray(args[0].string, args[0].option),\n            nonce = Utils.convertToByteArray(args[1].string, args[1].option),\n            ad = Utils.convertToByteArray(args[2].string, args[2].option),\n            inputType = args[3],\n            outputType = args[4];\n\n        if (key.length !== 16) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes.\n\nAscon-AEAD128 requires a key of exactly 16 bytes (128 bits).`);\n        }\n\n        if (nonce.length !== 16) {\n            throw new OperationError(`Invalid nonce length: ${nonce.length} bytes.\n\nAscon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).`);\n        }\n\n        // Convert input to byte array\n        const inputData = Utils.convertToByteArray(input, inputType);\n\n        const keyUint8 = new Uint8Array(key);\n        const nonceUint8 = new Uint8Array(nonce);\n        const adUint8 = new Uint8Array(ad);\n        const inputUint8 = new Uint8Array(inputData);\n","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AsconEncrypt.mjs#L58-L94","documentation":"Thrown by AsconEncrypt.run when the supplied key is not exactly 16 bytes (128 bits). Ascon-AEAD128 fixes the key at 128 bits, so key.length === 16 is enforced before invoking JsAscon.encrypt. The key length is measured in decoded bytes after Utils.convertToByteArray applies the chosen input option, so a hex key must be 32 characters and a base64 key must decode to exactly 16 bytes.","triggerScenarios":"Supplying a 32-byte key, a short UTF-8 passphrase, a hex string of wrong length, or a base64 value decoding to != 16 bytes.","commonSituations":"Reusing an AES-256 key or a raw SHA-256 digest as the Ascon key; pasting a passphrase expecting automatic key derivation; miscounting hex characters.","solutions":["Provide exactly 16 bytes of key material (32 hex chars).","Derive a 16-byte key from a passphrase using a KDF before Ascon.","Confirm the key input option (Hex/Base64/UTF8) matches the actual encoding."],"exampleFix":"// before\nchef.asconEncrypt(pt, { key: \"my-password\", keyOption: \"UTF8\" });\n\n// after\nchef.asconEncrypt(pt, { key: \"00112233445566778899aabbccddeeff\", keyOption: \"Hex\" });","handlingStrategy":"validation","validationCode":"import Utils from \"src/core/Utils.mjs\";\nfunction assertAsconKey(keyStr, keyOption) {\n  const bytes = Utils.convertToByteArray(keyStr, keyOption);\n  if (bytes.length !== 16) throw new Error(`Ascon key must be 16 bytes, got ${bytes.length}`);\n  return bytes;\n}\nassertAsconKey(key, keyOption);","typeGuard":"function is16ByteHex(s) { return /^[0-9a-f]{32}$/i.test(s); }","tryCatchPattern":null,"preventionTips":["Use exactly 16 bytes (32 hex chars) for the Ascon key.","Derive keys from passphrases with a KDF before Ascon.","Verify the input option matches the key encoding."],"tags":["crypto","aead","ascon","key-length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}