{"record":{"id":"b1d2ff5b20f8c271","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-des-uses","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes\n\nDES uses a key length of 8 bytes (64 bits).","messagePattern":"Invalid key length: (.+?) bytes\n\nDES uses a key length of 8 bytes \\(64 bits\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/DESDecrypt.mjs","lineNumber":73,"sourceCode":"                \"value\": [\"Raw\", \"Hex\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            mode = args[2].substring(0, 3),\n            noPadding = args[2].endsWith(\"NoPadding\"),\n            [,,, inputType, outputType] = args;\n\n        if (key.length !== 8) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nDES uses a key length of 8 bytes (64 bits).`);\n        }\n        if (iv.length !== 8 && mode !== \"ECB\") {\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nDES uses an IV length of 8 bytes (64 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        const decipher = forge.cipher.createDecipher(\"DES-\" + mode, key);\n\n        /* Allow for a \"no padding\" mode */\n        if (noPadding) {\n            decipher.mode.unpad = function(output, options) {\n                return true;","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/DESDecrypt.mjs#L55-L91","documentation":"Thrown by DES Decrypt run() when the supplied key, after conversion to a byte string via Utils.convertToByteString, is not exactly 8 bytes. DES mandates a fixed 64-bit (8-byte) key; node-forge's createDecipher rejects mismatched key material, and this check preempts that with a clear message. The length printed reflects the post-conversion byte count, not the raw user input length.","triggerScenarios":"Setting the Key argument with a value whose decoded byte length != 8. For example, 16 hex characters decode to 8 bytes (valid), but 'key123' in UTF8 is 6 bytes, or '00112233445566' is 7 hex bytes, or 'AABBCCDDEEFF00112233' is 10 hex bytes. Any Key toggle (Hex/UTF8/Latin1/Base64) whose decoded result is not 8 bytes triggers it.","commonSituations":"Confusing hex digits vs raw bytes (typing 8 ASCII characters thinking they are 8 bytes when Hex is selected, yielding 4 bytes); pasting a DES key with parity stripped; using an AES/3DES key by mistake; leaving the Key field with a default placeholder string.","solutions":["Provide exactly 8 bytes: either 16 hex digits (Hex), 8 ASCII characters (UTF8/Latin1), or 11 Base64 chars padding to 8 bytes.","Re-check the Key toggle matches how the key is encoded (Hex vs UTF8 vs Base64).","If you intended a longer key, switch to Triple DES or AES instead of single DES.","Verify the byte length: run the key through a From Hex / From Base64 op and check it yields 8 bytes."],"exampleFix":"// before - 6-byte UTF8 key\nKey: secret   (toggle: UTF8)\n\n// after - 8-byte key as hex\nKey: 7365637265742121   (toggle: Hex)  // decodes to 8 bytes 'secret!!'","handlingStrategy":"validation","validationCode":"function desKeyBytes(keyStr, option) {\n    const key = Utils.convertToByteString(keyStr, option);\n    return key.length === 8 ? key : null;\n}\n// if null, surface a UI error before calling desDecrypt.run()","typeGuard":"/** @returns {boolean} */\nfunction isValidDesKey(keyStr, option) {\n    try {\n        return Utils.convertToByteString(keyStr, option).length === 8;\n    } catch {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    out = desDecrypt.run(input, args);\n} catch (e) {\n    if (e instanceof OperationError && e.message.startsWith(\"Invalid key length\")) {\n        // prompt user to fix the key/encoding\n    } else throw e;\n}","preventionTips":["Always provide a DES key as exactly 8 bytes in the encoding matching the toggle.","Distinguish hex (2 chars/byte) from UTF8 (1 char/byte) when entering the key.","For passphrases, hash first instead of using the raw text as a DES key.","Validate byte length with a From Hex/From Base64 op before DES."],"tags":["crypto","des","key-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}