{"record":{"id":"645cd821a5b0af52","repo":"gchq/CyberChef","slug":"invalid-bit-padding-645cd8","errorCode":null,"errorMessage":"Invalid BIT padding.","messagePattern":"Invalid BIT padding\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/RC6.mjs","lineNumber":429,"sourceCode":"            if (padByte > 0 && padByte <= blockSize) {\n                // Verify padding\n                for (let i = 0; i < padByte; i++) {\n                    if (message[message.length - 1 - i] !== padByte) {\n                        throw new OperationError(\"Invalid PKCS#5 padding.\");\n                    }\n                }\n                return message.slice(0, message.length - padByte);\n            }\n            throw new OperationError(\"Invalid PKCS#5 padding.\");\n        }\n\n        case \"BIT\": {\n            // Find 0x80 byte working backwards, skipping zeros\n            for (let i = message.length - 1; i >= 0; i--) {\n                if (message[i] === 0x80) {\n                    return message.slice(0, i);\n                } else if (message[i] !== 0) {\n                    throw new OperationError(\"Invalid BIT padding.\");\n                }\n            }\n            throw new OperationError(\"Invalid BIT padding.\");\n        }\n\n        default:\n            throw new OperationError(`Unknown padding type: ${padding}`);\n    }\n}\n\n/**\n * Encrypt using RC6 cipher with specified block mode\n *\n * @param {number[]} message - Plaintext as byte array\n * @param {number[]} key - Key as byte array\n * @param {number[]} iv - IV (block size bytes, not used for ECB)\n * @param {string} mode - Block cipher mode (\"ECB\", \"CBC\", \"CFB\", \"OFB\", \"CTR\")\n * @param {string} padding - Padding type (\"NO\", \"PKCS5\", \"ZERO\", \"RANDOM\", \"BIT\")","sourceCodeStart":411,"sourceCodeEnd":447,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/RC6.mjs#L411-L447","documentation":"Thrown by RC6.removePadding for BIT (ISO/IEC 9797-1 padding method 2) when, scanning backwards, the decoder encounters a non-zero byte that is not the 0x80 terminator before finding the terminator — meaning the padding pattern is malformed. Also thrown if the scan completes with no 0x80 byte at all.","triggerScenarios":"Calling decryptRC6(...) with padding 'BIT' on plaintext whose tail is not a valid bit-padding sequence (0x80 followed by zero or more 0x00 bytes).","commonSituations":"Wrong key/IV producing random tail bytes; data padded with a different scheme but decrypted as BIT; message that legitimately ends in non-zero bytes with no 0x80 terminator; ciphertext truncated so the 0x80 byte is lost.","solutions":["Verify key/IV and that the sender actually used BIT padding.","Decrypt with 'NO' and inspect the tail to confirm a 0x80 terminator exists.","Switch the padding argument to match the sender's scheme."],"exampleFix":"// before: decrypt as BIT though data is PKCS5\nconst pt = decryptRC6(ct, key, iv, 'CBC', 'BIT');\n// after\nconst pt = decryptRC6(ct, key, iv, 'CBC', 'PKCS5');","handlingStrategy":"validation","validationCode":"function isValidBitPadding(message) {\n  for (let i = message.length - 1; i >= 0; i--) {\n    if (message[i] === 0x80) return true;\n    if (message[i] !== 0) return false;\n  }\n  return false;\n}","typeGuard":"function hasValidBitPadding(message) {\n  let seen80 = false;\n  for (let i = message.length - 1; i >= 0; i--) {\n    if (message[i] === 0x80) { seen80 = true; break; }\n    if (message[i] !== 0) return false;\n  }\n  return seen80;\n}","tryCatchPattern":"try {\n  return decryptRC6(ct, key, iv, mode, 'BIT', rounds, w);\n} catch (e) {\n  if (e instanceof OperationError && /Invalid BIT padding/.test(e.message)) {\n    // confirm sender used BIT; otherwise decrypt with 'NO' to inspect tail\n    return decryptRC6(ct, key, iv, mode, 'NO', rounds, w);\n  }\n  throw e;\n}","preventionTips":["Confirm the sender applied BIT (0x80...) padding.","Verify key/IV before trusting padding-strip output.","Inspect the decrypted tail with 'NO' padding when validation fails."],"tags":["crypto","rc6","padding","bit-padding","decrypt","operation-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}