{"record":{"id":"b54f7880356e4a5f","repo":"gchq/CyberChef","slug":"invalid-bit-padding-b54f78","errorCode":null,"errorMessage":"Invalid BIT padding.","messagePattern":"Invalid BIT padding\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/lib/TEA.mjs","lineNumber":250,"sourceCode":"            return message;\n\n        case \"PKCS5\": {\n            const padByte = message[message.length - 1];\n            if (padByte > 0 && padByte <= BLOCK_SIZE) {\n                for (let i = 0; i < padByte; i++) {\n                    if (message[message.length - 1 - i] !== padByte) {\n                        throw new OperationError(\"Invalid PKCS#5 padding.\");\n                    }\n                }\n                return message.slice(0, message.length - padByte);\n            }\n            throw new OperationError(\"Invalid PKCS#5 padding.\");\n        }\n\n        case \"BIT\": {\n            for (let i = message.length - 1; i >= 0; i--) {\n                if (message[i] === 0x80) return message.slice(0, i);\n                if (message[i] !== 0) throw new OperationError(\"Invalid BIT padding.\");\n            }\n            throw new OperationError(\"Invalid BIT padding.\");\n        }\n\n        default:\n            throw new OperationError(`Unknown padding type: ${padding}`);\n    }\n}\n\n/**\n * Encrypt with block cipher modes\n *\n * @param {number[]} message - Plaintext bytes\n * @param {number[]} key - 16-byte key\n * @param {number[]} iv - 8-byte IV (ignored for ECB)\n * @param {string} mode - \"ECB\", \"CBC\", \"CFB\", \"OFB\", \"CTR\"\n * @param {string} padding - \"PKCS5\", \"NO\", \"ZERO\", \"RANDOM\", \"BIT\"\n * @param {Function} encryptBlockFn - Block encrypt function","sourceCodeStart":232,"sourceCodeEnd":268,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/lib/TEA.mjs#L232-L268","documentation":"TEA's removePadding BIT case at TEA.mjs:250. BIT padding marks the start of padding with a 0x80 byte followed by zero bytes; walking backwards, the first non-zero byte encountered must be the 0x80 sentinel. This throw fires when a non-zero, non-0x80 byte is found before the sentinel — meaning the tail is not a well-formed BIT pad.","triggerScenarios":"Decryption with padding='BIT' where the trailing bytes contain a non-zero, non-0x80 value before the 0x80 sentinel is reached. Causes: wrong key producing random plaintext in the tail; partial corruption of the last block; encryptor used a different padding scheme but decryptor expects BIT.","commonSituations":"Key/IV mismatch; encrypt/decrypt padding scheme mismatch; bit-flip in the last ciphertext block producing a random tail.","solutions":["Confirm the key and IV match the encrypt side.","Verify the encrypt-time padding was 'BIT'.","Decrypt with 'NO' padding and inspect the tail bytes to identify the actual scheme."],"exampleFix":"// before\nconst pt = decryptWithBlockMode(ct, key, iv, \"CBC\", \"BIT\");\n// after: data was PKCS5-padded\nconst pt = decryptWithBlockMode(ct, key, iv, \"CBC\", \"PKCS5\");","handlingStrategy":"validation","validationCode":"function looksLikeValidBitPad(plain) {\n  let sawSentinel = false;\n  for (let i = plain.length - 1; i >= 0; i--) {\n    const b = plain[i];\n    if (b === 0x80) { sawSentinel = true; break; }\n    if (b !== 0) return false;\n  }\n  return sawSentinel;\n}","typeGuard":"function isWellFormedBitPad(plain) {\n  let sawSentinel = false;\n  for (let i = plain.length - 1; i >= 0; i--) {\n    const b = plain[i];\n    if (b === 0x80) { sawSentinel = true; break; }\n    if (b !== 0) return false;\n  }\n  return sawSentinel;\n}","tryCatchPattern":"import OperationError from \"../errors/OperationError.mjs\";\ntry {\n  const pt = decryptWithBlockMode(ct, key, iv, mode, \"BIT\");\n} catch (e) {\n  if (e instanceof OperationError && /Invalid BIT padding/.test(e.message)) {\n    // wrong key/IV or padding-scheme mismatch; do not return partial plaintext\n  } else throw e;\n}","preventionTips":["Match encrypt and decrypt padding literals exactly.","Avoid BIT padding for binary payloads that may contain 0x80 in-band.","Treat BIT padding failure as a wrong-key signal."],"tags":["tea","xtea","cipher","padding","bit-padding","decryption"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}