{"record":{"id":"dba9a9f185fcf561","repo":"gchq/CyberChef","slug":"input-must-be-8n-n-2-bytes-currently-input","errorCode":null,"errorMessage":"input must be 8n (n>=2) bytes (currently \" + inputData.length + \" bytes)","messagePattern":"input must be 8n \\(n>=2\\) bytes \\(currently \" \\+ inputData\\.length \\+ \" bytes\\)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/AESKeyWrap.mjs","lineNumber":75,"sourceCode":"     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const kek = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteString(args[1].string, args[1].option),\n            inputType = args[2],\n            outputType = args[3];\n\n        if (kek.length !== 16 && kek.length !== 24 && kek.length !== 32) {\n            throw new OperationError(\"KEK must be either 16, 24, or 32 bytes (currently \" + kek.length + \" bytes)\");\n        }\n        if (iv.length !== 8) {\n            throw new OperationError(\"IV must be 8 bytes (currently \" + iv.length + \" bytes)\");\n        }\n        const inputData = Utils.convertToByteString(input, inputType);\n        if (inputData.length % 8 !== 0 || inputData.length < 16) {\n            throw new OperationError(\"input must be 8n (n>=2) bytes (currently \" + inputData.length + \" bytes)\");\n        }\n\n        const cipher = forge.cipher.createCipher(\"AES-ECB\", kek);\n\n        let A = iv;\n        const R = [];\n        for (let i = 0; i < inputData.length; i += 8) {\n            R.push(inputData.substring(i, i + 8));\n        }\n        let cntLower = 1, cntUpper = 0;\n        for (let j = 0; j < 6; j++) {\n            for (let i = 0; i < R.length; i++) {\n                cipher.start();\n                cipher.update(forge.util.createBuffer(A + R[i]));\n                cipher.finish();\n                const B = cipher.output.getBytes();\n                const msbBuffer = Utils.strToArrayBuffer(B.substring(0, 8));\n                const msbView = new DataView(msbBuffer);","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/AESKeyWrap.mjs#L57-L93","documentation":"RFC 3394 requires the key material being wrapped to be at least 2 blocks (n≥2), i.e. a multiple of 8 bytes and ≥ 16 bytes. AESKeyWrap throws this when inputData.length % 8 !== 0 or inputData.length < 16. (Compare with unwrap, which needs ≥ 24 because the wrapped form adds one IV block.)","triggerScenarios":"The key-data input is not a multiple of 8 bytes, or is shorter than 16 bytes. For example, trying to wrap a single 8-byte block, or feeding an odd-length hex string that decodes to a non-multiple-of-8 byte count.","commonSituations":"Attempting to wrap a DES-size (8-byte) key (too small); format-option mismatch producing wrong byte count; truncated key material; user fed already-wrapped data by mistake.","solutions":["Confirm the input is the raw key material (e.g. a 16/24/32-byte AES key) you intend to protect.","Verify the input format option and that decoding yields a multiple of 8 bytes ≥ 16.","If you genuinely have an 8-byte key, note RFC 3394 disallows it — use a different wrapping scheme or pad per your protocol."],"exampleFix":"// before: wrap an 8-byte DES key → throws (n must be ≥2)\n// after: wrap a 16/24/32-byte AES key instead","handlingStrategy":"validation","validationCode":"function validateKeyMaterial(bytes) {\n  if (bytes.length % 8 !== 0 || bytes.length < 16) {\n    throw new Error(`Key material must be 8n (n>=2) bytes, got ${bytes.length}`);\n  }\n}","typeGuard":"function isWrappableKey(bytes) { return bytes.length >= 16 && bytes.length % 8 === 0; }","tryCatchPattern":"try { aesKeyWrap(...); } catch (e) { if (/input must be 8n/.test(e.message)) {/* supply ≥16-byte key material */} else throw e; }","preventionTips":["Wrap key material of at least 2 blocks (≥16 bytes).","Verify format option yields a multiple of 8 bytes ≥ 16.","RFC 3394 disallows a single 8-byte block — use another scheme for DES-size keys."],"tags":["aes","key-wrap","validation","length"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}