{"record":{"id":"8459983784ec2701","repo":"gchq/CyberChef","slug":"input-private-key-must-be-in-hex-and-should-be-32","errorCode":null,"errorMessage":"Input private key must be in hex; and should be 32 bytes","messagePattern":"Input private key must be in hex; and should be 32 bytes","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/SM2Decrypt.mjs","lineNumber":59,"sourceCode":"            {\n                name: \"Curve\",\n                type: \"option\",\n                \"value\": [\"sm2p256v1\"],\n                \"defaultIndex\": 0\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {ArrayBuffer}\n     */\n    run(input, args) {\n        const [privateKey, inputFormat, curveName] = args;\n\n        if (privateKey.length !== 64) {\n            throw new OperationError(\"Input private key must be in hex; and should be 32 bytes\");\n        }\n\n        const sm2 = new SM2(curveName, inputFormat);\n        sm2.setPrivateKey(privateKey);\n\n        const result = sm2.decrypt(input);\n        return result;\n    }\n\n}\n\nexport default SM2Decrypt;\n","sourceCodeStart":41,"sourceCodeEnd":72,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/SM2Decrypt.mjs#L41-L72","documentation":"Thrown by SM2 Decrypt when the supplied private key string is not exactly 64 characters long. SM2 on the sm2p256v1 curve uses a 256-bit (32-byte) private key, represented here as 64 hex characters; the length check is the only validation before setPrivateKey().","triggerScenarios":"Passing a private key that is shorter/longer than 64 hex chars, includes a '0x' prefix (making it 66 chars), contains whitespace, or was copied in a different encoding. The default placeholder 'DEADBEEF' (8 chars) always triggers this.","commonSituations":"Leaving the default placeholder; pasting a key with a 0x prefix or newlines; supplying a base64 or raw-byte key instead of hex; truncating a key during copy-paste.","solutions":["Provide a 64-character lowercase/uppercase hex string representing the 32-byte private key.","Strip any '0x' prefix, whitespace, and newlines from the key before passing.","If your key is in another format, convert it to 32-byte hex first (e.g. via the 'To Hex' operation)."],"exampleFix":"// before\nsm2Decrypt.run(ciphertext, [\"DEADBEEF\", \"C1C3C2\", \"sm2p256v1\"])\n// after\nsm2Decrypt.run(ciphertext, [\"164bf0eed4b1f3b7e1a1c1c7c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5\", \"C1C3C2\", \"sm2p256v1\"])","handlingStrategy":"validation","validationCode":"function normalizePrivateKey(key) {\n  let k = String(key).trim().replace(/^0x/i, \"\");\n  if (!/^[0-9a-fA-F]{64}$/.test(k)) {\n    throw new Error(\"Private key must be 64 hex chars (32 bytes)\");\n  }\n  return k;\n}","typeGuard":"function isValidSm2PrivateKey(k) {\n  return /^[0-9a-fA-F]{64}$/.test(String(k).trim().replace(/^0x/i, \"\"));\n}","tryCatchPattern":null,"preventionTips":["Strip 0x prefixes and whitespace before passing the key.","Provide the key as 64 hex characters, not base64 or raw bytes."],"tags":["crypto","sm2","key","operation","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}