{"record":{"id":"bd52d217d6108188","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-twofish-u","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes\n\nTwofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).","messagePattern":"Invalid key length: (.+?) bytes\n\nTwofish uses a key length of 16 bytes \\(128 bits\\), 24 bytes \\(192 bits\\), or 32 bytes \\(256 bits\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/TwofishDecrypt.mjs","lineNumber":77,"sourceCode":"                \"name\": \"Padding\",\n                \"type\": \"option\",\n                \"value\": [\"PKCS5\", \"NO\", \"ZERO\", \"RANDOM\", \"BIT\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteArray(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            [,, mode, inputType, outputType, padding] = args;\n\n        if (key.length !== 16 && key.length !== 24 && key.length !== 32)\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nTwofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).`);\n\n        if (iv.length !== 16 && mode !== \"ECB\")\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nTwofish uses an IV length of 16 bytes (128 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n\n        input = Utils.convertToByteArray(input, inputType);\n        const output = decryptTwofish(input, key, iv, mode, padding);\n        return outputType === \"Hex\" ? toHex(output, \"\") : Utils.byteArrayToUtf8(output);\n    }\n\n}\n\nexport default TwofishDecrypt;\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/TwofishDecrypt.mjs#L59-L95","documentation":"Thrown by 'Twofish Decrypt' when the key is not 16, 24, or 32 bytes. Twofish accepts 128/192/256-bit keys; the byte array is produced by Utils.convertToByteArray on args[0] using the chosen format option.","triggerScenarios":"A key whose decoded byte length is not 16/24/32: a 3DES 24-byte key is acceptable but a 3-byte or 20-byte key fails; most commonly a format-option mismatch makes the byte length wrong.","commonSituations":"Hex key supplied with UTF8 option (doubles the byte count), or a UTF8 passphrase used directly as a key. Also pasting a 3DES/AES key of the wrong size.","solutions":["Provide a 16, 24, or 32-byte key.","Confirm the key format option matches the key encoding.","Derive the key from a passphrase using a KDF (e.g. PBKDF2) to hit an allowed length."],"exampleFix":"// before: 32-char hex key read as UTF8 = 32 bytes (ok) but often mis-set\nargs[0] = { string: \"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f\", option: \"Hex\" };","handlingStrategy":"validation","validationCode":"const keyBytes = Utils.convertToByteArray(key.string, key.option);\nif (![16,24,32].includes(keyBytes.length)) {\n  throw new Error(`Twofish key must be 16/24/32 bytes, got ${keyBytes.length}`);\n}","typeGuard":"function isValidTwofishKey(bytes) { return [16,24,32].includes(bytes.length); }","tryCatchPattern":null,"preventionTips":["Verify the key format option before running.","Derive keys with a KDF to an allowed length."],"tags":["crypto","twofish","validation","key-length","argument-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}