{"record":{"id":"a3bf57a2810a36e5","repo":"gchq/CyberChef","slug":"input-must-be-8n-n-3-bytes-currently-input","errorCode":null,"errorMessage":"input must be 8n (n>=3) bytes (currently \" + inputData.length + \" bytes)","messagePattern":"input must be 8n \\(n>=3\\) bytes \\(currently \" \\+ inputData\\.length \\+ \" bytes\\)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AESKeyUnwrap.mjs","lineNumber":75,"sourceCode":"     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const kek = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteString(args[1].string, args[1].option),\n            inputType = args[2],\n            outputType = args[3];\n\n        if (kek.length !== 16 && kek.length !== 24 && kek.length !== 32) {\n            throw new OperationError(\"KEK must be either 16, 24, or 32 bytes (currently \" + kek.length + \" bytes)\");\n        }\n        if (iv.length !== 8) {\n            throw new OperationError(\"IV must be 8 bytes (currently \" + iv.length + \" bytes)\");\n        }\n        const inputData = Utils.convertToByteString(input, inputType);\n        if (inputData.length % 8 !== 0 || inputData.length < 24) {\n            throw new OperationError(\"input must be 8n (n>=3) bytes (currently \" + inputData.length + \" bytes)\");\n        }\n\n        const cipher = forge.cipher.createCipher(\"AES-ECB\", kek);\n        cipher.start();\n        cipher.update(forge.util.createBuffer(\"\"));\n        cipher.finish();\n        const paddingBlock = cipher.output.getBytes();\n\n        const decipher = forge.cipher.createDecipher(\"AES-ECB\", kek);\n\n        let A = inputData.substring(0, 8);\n        const R = [];\n        for (let i = 8; i < inputData.length; i += 8) {\n            R.push(inputData.substring(i, i + 8));\n        }\n        let cntLower = R.length >>> 0;\n        let cntUpper = (R.length / ((1 << 30) * 4)) >>> 0;\n        cntUpper = cntUpper * 6 + ((cntLower * 6 / ((1 << 30) * 4)) >>> 0);","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AESKeyUnwrap.mjs#L57-L93","documentation":"A wrapped key produced by RFC 3394 is always (n+1)·8 bytes where n≥2 is the number of key-data blocks; the unwrap therefore requires its input to be a multiple of 8 and at least 24 bytes (3 blocks: 1 IV block + ≥2 data blocks). AESKeyUnwrap throws this when inputData.length % 8 !== 0 or inputData.length < 24.","triggerScenarios":"The wrapped-key input is not a multiple of 8 bytes, or is 8 or 16 bytes (too short). Often caused by truncation, an extra/missing byte from hex decoding, or feeding a raw key instead of a wrapped key.","commonSituations":"Hex/base64 decoding produced an odd byte count; user fed the unwrapped key material by mistake; wrapped blob was truncated during copy-paste; format option mismatch on the input.","solutions":["Confirm the input is the actual wrapped-key output of AESKeyWrap (or another RFC 3394 implementation).","Verify the input format option (Hex/Base64/Latin1) and that decoding yields a multiple of 8 bytes ≥ 24.","Re-wrap the key to regenerate a valid blob."],"exampleFix":"// before: wrapped input 16 bytes (n=2, but unwrap needs ≥3 blocks) → throws\n// after: use the full wrapped output of AESKeyWrap (≥24 bytes)","handlingStrategy":"validation","validationCode":"function validateWrappedInput(bytes) {\n  if (bytes.length % 8 !== 0 || bytes.length < 24) {\n    throw new Error(`Wrapped input must be 8n (n>=3) bytes, got ${bytes.length}`);\n  }\n}","typeGuard":"function isUnwrappable(bytes) { return bytes.length >= 24 && bytes.length % 8 === 0; }","tryCatchPattern":"try { aesKeyUnwrap(...); } catch (e) { if (/input must be 8n/.test(e.message)) {/* supply full wrapped blob */} else throw e; }","preventionTips":["Feed only genuine RFC 3394 wrapped output.","Verify format option yields a multiple of 8 bytes ≥ 24.","Watch for copy-paste truncation of the wrapped blob."],"tags":["aes","key-wrap","validation","length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}