{"record":{"id":"c346ba8a91b7ccf6","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-des-uses-c346ba","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes\n\nDES uses a key length of 8 bytes (64 bits).","messagePattern":"Invalid key length: (.+?) bytes\n\nDES uses a key length of 8 bytes \\(64 bits\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/DESEncrypt.mjs","lineNumber":71,"sourceCode":"                \"name\": \"Output\",\n                \"type\": \"option\",\n                \"value\": [\"Hex\", \"Raw\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            [,, mode, inputType, outputType] = args;\n\n        if (key.length !== 8) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nDES uses a key length of 8 bytes (64 bits).`);\n        }\n        if (iv.length !== 8 && mode !== \"ECB\") {\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nDES uses an IV length of 8 bytes (64 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        const cipher = forge.cipher.createCipher(\"DES-\" + mode, key);\n        cipher.start({iv: iv});\n        cipher.update(forge.util.createBuffer(input));\n        cipher.finish();\n\n        return outputType === \"Hex\" ? cipher.output.toHex() : cipher.output.getBytes();","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/DESEncrypt.mjs#L53-L89","documentation":"Thrown by DES Encrypt run() when the supplied key, decoded via Utils.convertToByteString, is not exactly 8 bytes. Identical semantics to DES Decrypt's key check: DES uses a fixed 64-bit key, and this guard runs before forge's createCipher. Encryption is deterministic given a valid key, so this is purely a length/format problem, not a value problem.","triggerScenarios":"Key argument whose decoded byte length != 8 under the selected toggle (Hex/UTF8/Latin1/Base64). Examples: 'password' in UTF8 is 8 bytes (valid); 'pass' in UTF8 is 4 bytes (fails); '0123456789abcdef' is 8 bytes in Hex but 16 in UTF8.","commonSituations":"Mismatched key toggle (Hex vs UTF8); pasting a human-readable passphrase and expecting it to be hashed (DES takes the raw key, not a derived one); reusing an AES key; typo in hex (odd-length hex silently produces wrong byte count upstream).","solutions":["Provide an 8-byte key in the encoding matching the toggle (16 hex digits, 8 UTF8 chars, etc.).","Re-check the Key toggle against the key's encoding.","If you need to use a passphrase, hash it first (e.g. MD5 then truncate to 8 bytes) or switch to a passphrase-based KDF recipe.","Validate byte length with a From Hex/From Base64 op before the DES Encrypt."],"exampleFix":"// before\nKey: mySecretKey   (toggle: UTF8)  // 11 bytes -> error\n\n// after\nKey: 6d795365637265744b657921   (toggle: Hex) // choose 16 hex = 8 bytes\n// or trim to 8 UTF8 chars","handlingStrategy":"validation","validationCode":"function desKeyBytes(keyStr, option) {\n    const key = Utils.convertToByteString(keyStr, option);\n    return key.length === 8 ? key : null;\n}","typeGuard":"/** @returns {boolean} */\nfunction isValidDesKey(keyStr, option) {\n    try {\n        return Utils.convertToByteString(keyStr, option).length === 8;\n    } catch {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    out = desEncrypt.run(input, args);\n} catch (e) {\n    if (e instanceof OperationError && e.message.startsWith(\"Invalid key length\")) {\n        // fix key/encoding\n    } else throw e;\n}","preventionTips":["Provide exactly 8 bytes for the DES key in the matching encoding.","Hash long passphrases before using them as a DES key.","Verify hex keys are 16 digits, UTF8 keys are 8 chars.","Validate with a From Hex/From Base64 op first."],"tags":["crypto","des","key-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}