{"record":{"id":"94346198cb439849","repo":"gchq/CyberChef","slug":"iv-mismatch","errorCode":null,"errorMessage":"IV mismatch","messagePattern":"IV mismatch","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AESKeyUnwrap.mjs","lineNumber":116,"sourceCode":"                const aView = new DataView(aBuffer);\n                aView.setUint32(0, aView.getUint32(0) ^ cntUpper);\n                aView.setUint32(4, aView.getUint32(4) ^ cntLower);\n                A = Utils.arrayBufferToStr(aBuffer, false);\n                decipher.start();\n                decipher.update(forge.util.createBuffer(A + R[i] + paddingBlock));\n                decipher.finish();\n                const B = decipher.output.getBytes();\n                A = B.substring(0, 8);\n                R[i] = B.substring(8, 16);\n                cntLower--;\n                if (cntLower < 0) {\n                    cntUpper--;\n                    cntLower = 0xffffffff;\n                }\n            }\n        }\n        if (A !== iv) {\n            throw new OperationError(\"IV mismatch\");\n        }\n        const P = R.join(\"\");\n\n        if (outputType === \"Hex\") {\n            return toHexFast(Utils.strToArrayBuffer(P));\n        }\n        return P;\n    }\n\n}\n\nexport default AESKeyUnwrap;\n","sourceCodeStart":98,"sourceCodeEnd":129,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AESKeyUnwrap.mjs#L98-L129","documentation":"The last step of RFC 3394 unwrap compares the recovered 8-byte integrity register A against the expected IV; a mismatch proves the data did not unwrap correctly (wrong KEK, wrong IV, or corrupted wrapped blob). This is an authenticated integrity failure — unlike a padding oracle, AES-KW gives a clean yes/no.","triggerScenarios":"After the 6·n rounds complete, the recovered A != iv. Causes: KEK differs from the one used to wrap; the wrap used a non-default IV that was not supplied here; the wrapped bytes were altered/truncated/reordered; format-option mismatch silently changed bytes.","commonSituations":"Wrong KEK (most common); default IV A6A6A6A6… assumed but the wrap used a custom IV; copy-paste truncation of the wrapped blob; hex/base64 format mismatch on KEK or wrapped data.","solutions":["Confirm the KEK is byte-identical to the one used during wrap (and its format option is correct).","If the wrap used a non-standard IV, supply that exact 8-byte IV; otherwise use A6A6A6A6A6A6A6A6.","Verify the wrapped input was not truncated or altered and that its format option matches.","Re-wrap with the intended KEK/IV to produce a known-good blob for comparison."],"exampleFix":"// before: unwrap with wrong KEK → 'IV mismatch'\n// after: supply the exact KEK used during AESKeyWrap (same bytes, same format option)","handlingStrategy":"try-catch","validationCode":"function preflightUnwrap(kekBytes, ivBytes, wrappedBytes) {\n  if (![16,24,32].includes(kekBytes.length)) throw new Error('bad KEK length');\n  if (ivBytes.length !== 8) throw new Error('bad IV length');\n  if (wrappedBytes.length < 24 || wrappedBytes.length % 8 !== 0) throw new Error('bad wrapped length');\n}","typeGuard":"function unwrapParamsOk(kek, iv, wrapped) { return isAesKek(kek) && isWrapIv(iv) && isUnwrappable(wrapped); }","tryCatchPattern":"try {\n  return aesKeyUnwrap(wrapped, kek, iv);\n} catch (e) {\n  if (/IV mismatch/.test(e.message)) {\n    // integrity failure: wrong KEK, wrong IV, or corrupted blob — do not retry blindly\n    throw new Error('Key-wrap integrity check failed: verify KEK, IV, and wrapped data');\n  }\n  throw e;\n}","preventionTips":["Confirm the KEK is byte-identical to the wrap-time KEK.","Use the correct 8-byte IV (default A6A6… unless wrap used a custom one).","Guard the wrapped blob against truncation/alteration in transit."],"tags":["aes","key-wrap","integrity","auth"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}