{"record":{"id":"92134136ef99baa5","repo":"gchq/CyberChef","slug":"invalid-iv-length-iv-length-bytes-des-uses-an-921341","errorCode":null,"errorMessage":"Invalid IV length: ${iv.length} bytes\n\nDES uses an IV length of 8 bytes (64 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).","messagePattern":"Invalid IV length: (.+?) bytes\n\nDES uses an IV length of 8 bytes \\(64 bits\\)\\.\nMake sure you have specified the type correctly \\(e\\.g\\. Hex vs UTF8\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/DESEncrypt.mjs","lineNumber":76,"sourceCode":"    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            [,, mode, inputType, outputType] = args;\n\n        if (key.length !== 8) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nDES uses a key length of 8 bytes (64 bits).`);\n        }\n        if (iv.length !== 8 && mode !== \"ECB\") {\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nDES uses an IV length of 8 bytes (64 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        const cipher = forge.cipher.createCipher(\"DES-\" + mode, key);\n        cipher.start({iv: iv});\n        cipher.update(forge.util.createBuffer(input));\n        cipher.finish();\n\n        return outputType === \"Hex\" ? cipher.output.toHex() : cipher.output.getBytes();\n    }\n\n}\n\nexport default DESEncrypt;","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/DESEncrypt.mjs#L58-L94","documentation":"Thrown by DES Encrypt run() when the decoded IV is not 8 bytes and the mode is not ECB. Same guard and reasoning as DES Decrypt's IV check: DES block size is 64 bits, so every non-ECB mode requires an 8-byte IV. The explicit Hex-vs-UTF8 hint targets the most common misconfiguration.","triggerScenarios":"Selecting CBC/CFB/OFB/CTR with an IV whose decoded length != 8; empty IV field yielding a 0-length array; AES-length (16-byte) IV reused for DES; wrong toggle causing a halving or doubling of the expected byte count.","commonSituations":"IV toggle mismatch (Hex vs UTF8); empty IV expecting a default zero IV that the code does not synthesize; copying an IV from another cipher recipe; mistyping hex digits.","solutions":["Provide an 8-byte IV (16 hex digits, 8 UTF8 chars, or ~11 Base64 chars).","Switch to ECB if no IV is available.","Confirm the IV toggle matches the encoding.","Generate a random 8-byte IV if the source did not specify one."],"exampleFix":"// before\nIV: 00112233445566778899aabbccddeeff   (toggle: Hex) // 16 bytes -> error\n\n// after\nIV: 0011223344556677   (toggle: Hex) // 8 bytes","handlingStrategy":"validation","validationCode":"function isValidDesIv(ivStr, option, mode) {\n    if (mode.substring(0, 3) === \"ECB\") return true;\n    try {\n        return Utils.convertToByteArray(ivStr, option).length === 8;\n    } catch {\n        return false;\n    }\n}","typeGuard":"/** @returns {boolean} */\nfunction isValidDesIv(ivStr, option, mode) {\n    if (mode.substring(0, 3) === \"ECB\") return true;\n    try {\n        return Utils.convertToByteArray(ivStr, option).length === 8;\n    } catch {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    out = desEncrypt.run(input, args);\n} catch (e) {\n    if (e instanceof OperationError && e.message.startsWith(\"Invalid IV length\")) {\n        // fix IV or use ECB\n    } else throw e;\n}","preventionTips":["Supply an 8-byte IV for non-ECB DES modes.","Confirm the IV toggle matches the value encoding.","Generate a cryptographically random 8-byte IV when none is specified.","Avoid reusing AES-length IVs for DES."],"tags":["crypto","des","iv-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}