{"record":{"id":"7689d443d28f750d","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-the-follo-7689d4","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes\n\nThe following algorithms will be used based on the size of the key:\n  16 bytes = AES-128\n  24 bytes = AES-192\n  32 bytes = AES-256","messagePattern":"Invalid key length: (.+?) bytes\n\nThe following algorithms will be used based on the size of the key:\n  16 bytes = AES-128\n  24 bytes = AES-192\n  32 bytes = AES-256","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AESEncrypt.mjs","lineNumber":123,"sourceCode":"    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     *\n     * @throws {OperationError} if invalid key length\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteString(args[1].string, args[1].option),\n            mode = args[2].split(\"/\")[0],\n            noPadding = args[2].endsWith(\"NoPadding\"),\n            inputType = args[3],\n            outputType = args[4],\n            aad = Utils.convertToByteString(args[5].string, args[5].option),\n            includeIV = args[6];\n\n        if ([16, 24, 32].indexOf(key.length) < 0) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nThe following algorithms will be used based on the size of the key:\n  16 bytes = AES-128\n  24 bytes = AES-192\n  32 bytes = AES-256`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        // Handle NoPadding modes\n        if (noPadding && input.length % 16 !== 0) {\n            throw new OperationError(\"Input length must be a multiple of 16 bytes for NoPadding modes.\");\n        }\n        const cipher = forge.cipher.createCipher(\"AES-\" + mode, key);\n        cipher.start({\n            iv: iv,\n            additionalData: mode === \"GCM\" ? aad : undefined\n        });","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AESEncrypt.mjs#L105-L141","documentation":"AESEncrypt enforces the same AES key-size rule as the decryptor: the key, after conversion to a byte string, must be exactly 16, 24, or 32 bytes (AES-128/192/256). The check runs before any encryption work.","triggerScenarios":"Utils.convertToByteString(args[0].string, args[0].option) yields a length outside {16, 24, 32}. Typically a Key Format option that does not match the supplied key text (Hex/UTF8/Base64 confusion), or a passphrase used directly as a key.","commonSituations":"Pasting a 32-char hex key while Key Format is UTF8 (→ 32 bytes / AES-256 instead of intended 16-byte AES-128); using a short password verbatim; key truncated in transit.","solutions":["Set the Key Format option to match the key representation (Hex for hex, Base64 for base64, UTF8 only for raw text).","Verify the resulting byte length is exactly 16, 24, or 32.","Derive passphrases through PBKDF2 or hash to a fixed length before using them as an AES key."],"exampleFix":"// before: 16-byte raw key supplied with format Hex → 8 bytes, throws\n// after: set Key Format to \"UTF8\" (or Latin1) for a raw 16-char key","handlingStrategy":"validation","validationCode":"function validateAesKey(keyBytes) {\n  if (![16, 24, 32].includes(keyBytes.length)) {\n    throw new Error(`Key must be 16/24/32 bytes, got ${keyBytes.length}`);\n  }\n}","typeGuard":"function isAesKey(bytes) { return bytes instanceof Uint8Array && [16, 24, 32].includes(bytes.length); }","tryCatchPattern":"try { encryptAES(...); } catch (e) { if (/Invalid key length/.test(e.message)) {/* fix key format */} else throw e; }","preventionTips":["Match the key format option to the key representation.","Derive passphrases to a fixed AES key length.","Assert byte length before encrypting."],"tags":["aes","crypto","key-management","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}