{"record":{"id":"9e0c65f02fda233a","repo":"gchq/CyberChef","slug":"invalid-iv-length-iv-length-bytes-expected-8","errorCode":null,"errorMessage":"Invalid IV length: ${iv.length} bytes. Expected 8 bytes.","messagePattern":"Invalid IV length: (.+?) bytes\\. Expected 8 bytes\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/BlowfishDecrypt.mjs","lineNumber":80,"sourceCode":"     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteString(args[1].string, args[1].option),\n            mode = args[2],\n            inputType = args[3],\n            outputType = args[4];\n\n        if (key.length < 4 || key.length > 56) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nBlowfish's key length needs to be between 4 and 56 bytes (32-448 bits).`);\n        }\n\n        if (mode !== \"ECB\" && iv.length !== 8) {\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes. Expected 8 bytes.`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        const decipher = Blowfish.createDecipher(key, mode);\n        decipher.start({iv: iv});\n        decipher.update(forge.util.createBuffer(input));\n        const result = decipher.finish();\n\n        if (result) {\n            return outputType === \"Hex\" ? decipher.output.toHex() : decipher.output.getBytes();\n        } else {\n            throw new OperationError(\"Unable to decrypt input with these parameters.\");\n        }\n    }\n\n}\n","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/BlowfishDecrypt.mjs#L62-L98","documentation":"Blowfish is a 64-bit block cipher, so every non-ECB chaining mode requires an 8-byte initialization vector. This throws when mode is not ECB and the IV's byte length differs from 8.","triggerScenarios":"Calling BlowfishDecrypt.run with mode in {CBC, CFB, OFB, CTR} (anything but ECB) and args[1] IV whose byte length is not exactly 8.","commonSituations":"Reusing a 16-byte AES IV by mistake; wrong IV encoding option; forgetting to supply an IV for CBC/CFB/OFB modes; pasting IV with whitespace.","solutions":["Provide an 8-byte IV for any mode other than ECB.","Confirm args[1].option matches the IV encoding (Hex/Base64/UTF8).","If you have no IV, switch the mode to ECB (not recommended for new designs)."],"exampleFix":"// before\nmode='CBC', iv option 'Hex' with '00112233445566778899' (10 bytes)\n// after\nmode='CBC', iv option 'Hex' with '0011223344556677' (8 bytes)","handlingStrategy":"validation","validationCode":"const ivBytes = Utils.convertToByteString(args[1].string, args[1].option);\nif (args[2] !== 'ECB' && ivBytes.length !== 8) {\n  throw new Error('IV must be 8 bytes for non-ECB Blowfish');\n}","typeGuard":"function isValidBlowfishIV(mode, len) { return mode === 'ECB' || len === 8; }","tryCatchPattern":null,"preventionTips":["Always pair non-ECB Blowfish with an 8-byte IV.","Generate the IV with a CSPRNG and store it alongside the ciphertext.","Confirm the IV encoding option matches how the IV is stored."],"tags":["crypto","blowfish","iv-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}