{"record":{"id":"a2c50b0ec0bf4323","repo":"gchq/CyberChef","slug":"invalid-bit-padding","errorCode":null,"errorMessage":"Invalid BIT padding.","messagePattern":"Invalid BIT padding\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/Present.mjs","lineNumber":309,"sourceCode":"            if (padByte > 0 && padByte <= blockSize) {\n                // Verify padding\n                for (let i = 0; i < padByte; i++) {\n                    if (message[message.length - 1 - i] !== padByte) {\n                        throw new OperationError(\"Invalid PKCS#5 padding.\");\n                    }\n                }\n                return message.slice(0, message.length - padByte);\n            }\n            throw new OperationError(\"Invalid PKCS#5 padding.\");\n        }\n\n        case \"BIT\": {\n            // Find 0x80 byte working backwards, skipping zeros\n            for (let i = message.length - 1; i >= 0; i--) {\n                if (message[i] === 0x80) {\n                    return message.slice(0, i);\n                } else if (message[i] !== 0) {\n                    throw new OperationError(\"Invalid BIT padding.\");\n                }\n            }\n            throw new OperationError(\"Invalid BIT padding.\");\n        }\n\n        default:\n            throw new OperationError(`Unknown padding type: ${padding}`);\n    }\n}\n\n/**\n * Encrypt using PRESENT cipher with specified block mode\n *\n * @param {number[]} message - Plaintext as byte array\n * @param {number[]} key - Key (10 bytes for 80-bit or 16 bytes for 128-bit)\n * @param {number[]} iv - IV (8 bytes, not used for ECB)\n * @param {string} mode - Block cipher mode (\"ECB\" or \"CBC\")\n * @param {string} padding - Padding type (\"NO\", \"PKCS5\", \"ZERO\", \"RANDOM\", \"BIT\")","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/Present.mjs#L291-L327","documentation":"removePadding BIT (ISO 7816-4) branch walks backwards from the end expecting zero bytes followed by a single 0x80 terminator. If a non-zero, non-0x80 byte is encountered first, the padding is not a valid BIT sequence and decryption is rejected. Symptom of a wrong key or corrupted tail.","triggerScenarios":"Calling decryptPRESENT(..., 'BIT') where the decrypted tail contains arbitrary non-zero bytes before any 0x80 marker. Typical with wrong key/IV, or when the data was not BIT-padded.","commonSituations":"Wrong key producing random plaintext; BIT padding not actually used on the encrypt side (e.g. PKCS5 was); corrupted final ciphertext block; mismatched IV in CBC mode.","solutions":["Verify the key matches the encrypting side exactly.","Confirm BIT padding was used to encrypt; if not, pass the matching padding type.","Decrypt with padding='NO' and inspect the tail bytes for a 0x80 marker.","Check the IV and ciphertext integrity in CBC mode."],"exampleFix":"// before\nconst pt = decryptPRESENT(ct, key, iv, 'CBC', 'BIT'); // tail has stray byte -> error\n\n// after\nconst raw = decryptPRESENT(ct, key, iv, 'CBC', 'NO');\nconsole.log(raw.slice(-8)); // look for 0x80 terminator\n// if no 0x80 present, try the actual scheme:\nconst pt = decryptPRESENT(ct, key, iv, 'CBC', 'PKCS5');","handlingStrategy":"try-catch","validationCode":"function hasValidBITPadding(bytes) {\n  for (let i = bytes.length - 1; i >= 0; i--) {\n    if (bytes[i] === 0x80) return true;\n    if (bytes[i] !== 0) return false;\n  }\n  return false;\n}\n\nconst raw = decryptPRESENT(ct, key, iv, mode, 'NO');\nif (!hasValidBITPadding(raw)) throw new Error('Wrong key or non-BIT-padded source');","typeGuard":null,"tryCatchPattern":"try {\n  return decryptPRESENT(ct, key, iv, mode, 'BIT');\n} catch (e) {\n  if (!/BIT padding/.test(e.message)) throw e;\n  const raw = decryptPRESENT(ct, key, iv, mode, 'NO');\n  throw new Error('No valid BIT padding found; key is probably wrong or scheme is not BIT');\n}","preventionTips":["Confirm the encrypting party used BIT (ISO 7816-4) padding.","Verify the key and IV are correct.","Use PKCS5 instead if you control both ends - it has clearer failure modes.","Inspect the raw tail bytes when decryption fails to choose the correct padding scheme."],"tags":["cryptography","present","padding","decryption","wrong-key"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}