{"record":{"id":"98208aff83d742de","repo":"moonD4rk/HackBrowserData","slug":"unsupported-iv-length","errorCode":null,"errorMessage":"unsupported IV length","messagePattern":"unsupported IV length","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crypto/errors.go","lineNumber":12,"sourceCode":"package crypto\n\nimport \"errors\"\n\n// Sentinel errors for crypto operations.\nvar (\n\terrShortCiphertext   = errors.New(\"ciphertext too short\")\n\terrInvalidBlockSize  = errors.New(\"ciphertext is not a multiple of the block size\")\n\terrInvalidIVLength   = errors.New(\"IV length must equal block size\")\n\terrInvalidPadding    = errors.New(\"invalid PKCS5 padding\")\n\terrInvalidNonceLen   = errors.New(\"nonce length must equal GCM nonce size\")\n\terrUnsupportedIVLen  = errors.New(\"unsupported IV length\")\n\terrDecodeASN1        = errors.New(\"failed to decode ASN1 data\")\n\terrDPAPINotSupported = errors.New(\"DPAPI not supported on this platform\") //nolint:unused // used on darwin/linux only\n)\n","sourceCodeStart":1,"sourceCodeEnd":16,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/crypto/errors.go#L1-L16","documentation":"errUnsupportedIVLen is returned by the ASN.1 PBE Decrypt/Encrypt methods when the per-algorithm branch cannot handle the derived IV length. The PBE parser supports specific IV sizes (e.g. 8-byte 3DES and 16-byte AES); anything else means the blob was parsed with wrong offsets or uses an unhandled cipher OID.","triggerScenarios":"NewASN1PBE succeeded but the IV carved from the ASN.1 parameters has a length not covered by the switch in decrypt/encrypt (asn1pbe.go:195/207), so the default branch returns this error.","commonSituations":"Firefox key4.db/logins.json items encrypted with unusual or newer PBE parameters; parsing a foreign profile whose algorithm identifiers were not produced by NSS; corrupt parameter sequences causing wrong IV slicing.","solutions":["Inspect the ASN.1 parameters (algorithm OID, salt and IV lengths) and add support for that cipher in the PBE switch.","Re-derive the parameter offsets; wrong ASN.1 field slicing produces bogus IV lengths.","Fall back to the documented Firefox paths (key4.db 3DES/AES-CBC) and confirm the item's encryption scheme.","If the blob is truly unsupported, skip it and report the OID so the case can be added upstream."],"exampleFix":"// before\nswitch len(iv) {\ncase 8: ...\ncase 16: ...\ndefault: return nil, errUnsupportedIVLen\n}\n// after\nswitch len(iv) {\ncase 8:  ... // 3DES\ncase 16: ... // AES-CBC\ncase 24: ... // add missing cipher handling\ndefault: return nil, fmt.Errorf(\"unsupported IV len %d: %w\", len(iv), errUnsupportedIVLen)\n}","handlingStrategy":"try-catch","validationCode":"switch len(iv) {\ncase 8, 16:\n    // supported\ndefault:\n    return fmt.Errorf(\"PBE IV len %d unsupported\", len(iv))\n}","typeGuard":null,"tryCatchPattern":"plain, err := pbe.Decrypt(password)\nif errors.Is(err, crypto.ErrUnsupportedIVLen) {\n    return fmt.Errorf(\"unsupported PBE cipher (IV %d bytes): %w\", len(iv), err)\n}","preventionTips":["Inspect the algorithm OID in the ASN.1 parameters before decrypting.","Check the library's supported cipher list for your Firefox version.","Log salt/IV lengths when parsing PBE structures to catch mis-slicing.","Handle unsupported ciphers by skipping records, not aborting."],"tags":["crypto","asn1","pbe","firefox","unsupported-algorithm"],"backgroundTag":"unsupported-operation","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}