{"record":{"id":"8af0146cdc9b1a78","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-tea-requi-8af014","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes\n\nTEA requires a key length of 16 bytes (128 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).","messagePattern":"Invalid key length: (.+?) bytes\n\nTEA requires a key length of 16 bytes \\(128 bits\\)\\.\nMake sure you have specified the type correctly \\(e\\.g\\. Hex vs UTF8\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/TEAEncrypt.mjs","lineNumber":77,"sourceCode":"                \"name\": \"Padding\",\n                \"type\": \"option\",\n                \"value\": [\"PKCS5\", \"NO\", \"ZERO\", \"RANDOM\", \"BIT\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteArray(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            [,, mode, inputType, outputType, padding] = args;\n\n        if (key.length !== 16)\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nTEA requires a key length of 16 bytes (128 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n\n        if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== \"ECB\")\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nTEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n\n        // Default IV to null bytes if empty (like AES)\n        const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;\n\n        input = Utils.convertToByteArray(input, inputType);\n        const output = encryptTEA(input, key, actualIv, mode, padding);\n        return outputType === \"Hex\" ? toHex(output, \"\") : Utils.byteArrayToUtf8(output);\n    }\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/TEAEncrypt.mjs#L59-L95","documentation":"TEA Encrypt requires the key to decode to exactly 16 bytes (128 bits), the only key size the TEA algorithm supports. Any other decoded length is rejected up front because the cipher's key schedule indexes all 16 bytes via four 32-bit words.","triggerScenarios":"Supplying a Key toggleString whose decoded byte length is not 16. Example: entering a 16-character ASCII passphrase as UTF8 gives 16 bytes and passes, but entering the same string as Hex decodes to 8 bytes and fails. Entering fewer/more hex characters than 32, or a Base64 string that decodes to a non-16 length, also triggers it.","commonSituations":"Type/option mismatch (Hex vs UTF8) on the key field; pasting a human passphrase instead of raw key bytes; reusing an AES-128 key that is 16 bytes but selecting the wrong format toggle so it decodes to a different length.","solutions":["Provide the key as Hex with exactly 32 hex digits (16 bytes), e.g. 000102030405060708090a0b0c0d0e0f.","Or provide exactly 16 UTF8/Latin1 characters.","Confirm the format option matches how your key is encoded.","Double-check there are no stray whitespace characters in the key field."],"exampleFix":"// before: Key = \"0123456789abcdef\" option Hex   -> 8 bytes, fails\n// after:  Key = \"0123456789abcdef0123456789abcdef\" option Hex -> 16 bytes, passes","handlingStrategy":"validation","validationCode":"const keyBytes = Utils.convertToByteArray(keyString, keyOption);\nif (keyBytes.length !== 16) {\n  throw new Error(`TEA key must be 16 bytes, got ${keyBytes.length}`);\n}","typeGuard":"function isValidTeaKey(keyBytes) { return keyBytes.length === 16; }","tryCatchPattern":"try { chef.TEAEncrypt(input, [...]); }\ncatch (e) { if (/Invalid key length/.test(e.message)) { /* regenerate/extend key to 16 bytes */ } else throw e; }","preventionTips":["Generate keys as 16 random bytes and store as 32 hex characters.","Keep the key format option aligned with the storage encoding.","Avoid deriving keys from variable-length passphrases without a KDF."],"tags":["crypto","tea","key","validation","argument"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}