{"record":{"id":"b344ada227776475","repo":"gchq/CyberChef","slug":"input-is-too-short-to-contain-an-iv-of-ivlength","errorCode":null,"errorMessage":"Input is too short to contain an IV of ${ivLength} bytes.","messagePattern":"Input is too short to contain an IV of (.+?) bytes\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AESDecrypt.mjs","lineNumber":164,"sourceCode":"            gcmTag = Utils.convertToByteString(args[6].string, args[6].option),\n            aad = Utils.convertToByteString(args[7].string, args[7].option),\n            ivFromInput = args[8];\n\n\n        if ([16, 24, 32].indexOf(key.length) < 0) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nThe following algorithms will be used based on the size of the key:\n  16 bytes = AES-128\n  24 bytes = AES-192\n  32 bytes = AES-256`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        if (ivFromInput !== \"Off\") {\n            if (input.length <= ivLength) {\n                throw new OperationError(`Input is too short to contain an IV of ${ivLength} bytes.`);\n            }\n\n            if (ivFromInput === \"From start\") {\n                iv = input.substr(0, ivLength);\n                input = input.substr(ivLength);\n            } else {\n                iv = input.substr(input.length - ivLength);\n                input = input.substr(0, input.length - ivLength);\n            }\n        } else {\n            iv = Utils.convertToByteString(args[1].string, args[1].option);\n        }\n\n        const decipher = forge.cipher.createDecipher(\"AES-\" + mode, key);\n\n        /* Allow for a \"no padding\" mode */\n        if (noPadding) {\n            decipher.mode.unpad = function (output, options) {","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AESDecrypt.mjs#L146-L182","documentation":"When AESDecrypt is configured to read the IV from the input ('From start' or 'From end'), the ciphertext must be strictly longer than ivLength bytes so that at least one byte of actual ciphertext remains after the IV is sliced off. This guard rejects inputs that are too short to contain both an IV and any ciphertext.","triggerScenarios":"args[8] (ivFromInput) is not 'Off', and input.length <= ivLength (args[2], typically 16 for AES-CBC or 12 for GCM nonce scenarios). For example, feeding a 16-byte blob with IV 'From start' and ivLength 16 leaves nothing to decrypt.","commonSituations":"The IV was not actually prepended/appended to the ciphertext during encryption; the ciphertext was truncated; ivLength was set to a value larger than what the encryptor used; confusion between GCM 12-byte nonce and CBC 16-byte IV.","solutions":["Provide the full blob exactly as output by the encryptor (IV concatenated with ciphertext).","If the IV is supplied separately, set IV From Input to 'Off' and pass the IV in the IV argument.","Set ivLength (args[2]) to the correct value (16 for AES-CBC IV, 12 for a typical GCM nonce).","Re-encrypt a fresh sample and confirm the prepended/appended IV length matches ivLength."],"exampleFix":"// before: ivFromInput='From start', ivLength=16, input is 16 bytes → throws\n// after: supply input = IV(16) + ciphertext(>=1 block) so total > 16","handlingStrategy":"validation","validationCode":"function assertInputHasIvRoom(inputBytes, ivLength) {\n  if (inputBytes.length <= ivLength) {\n    throw new Error(`Input (${inputBytes.length}B) too short for IV of ${ivLength}B`);\n  }\n}","typeGuard":"function inputContainsIv(bytes, ivLength) { return bytes.length > ivLength; }","tryCatchPattern":"try { decryptAES(...); } catch (e) { if (/too short to contain an IV/.test(e.message)) {/* supply full ciphertext or switch IV mode off */} else throw e; }","preventionTips":["Provide the full ciphertext-with-IV blob exactly as encrypted.","If IV is separate, set IV From Input to 'Off'.","Match ivLength to the encryptor's IV size (16 CBC, 12 GCM nonce typical)."],"tags":["aes","iv","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}