{"record":{"id":"dd0b76e5657f5291","repo":"gchq/CyberChef","slug":"invalid-key-length-key-length-bytes-twofish-u-dd0b76","errorCode":null,"errorMessage":"Invalid key length: ${key.length} bytes\n\nTwofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).","messagePattern":"Invalid key length: (.+?) bytes\n\nTwofish uses a key length of 16 bytes \\(128 bits\\), 24 bytes \\(192 bits\\), or 32 bytes \\(256 bits\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/TwofishEncrypt.mjs","lineNumber":77,"sourceCode":"                \"name\": \"Padding\",\n                \"type\": \"option\",\n                \"value\": [\"PKCS5\", \"NO\", \"ZERO\", \"RANDOM\", \"BIT\"]\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteArray(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            [,, mode, inputType, outputType, padding] = args;\n\n        if (key.length !== 16 && key.length !== 24 && key.length !== 32)\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nTwofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).`);\n\n        if (iv.length !== 16 && mode !== \"ECB\")\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nTwofish uses an IV length of 16 bytes (128 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n\n        input = Utils.convertToByteArray(input, inputType);\n        const output = encryptTwofish(input, key, iv, mode, padding);\n        return outputType === \"Hex\" ? toHex(output, \"\") : Utils.byteArrayToUtf8(output);\n    }\n\n}\n\nexport default TwofishEncrypt;\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/TwofishEncrypt.mjs#L59-L95","documentation":"Thrown by 'Twofish Encrypt' when the key is not 16, 24, or 32 bytes. Same length set as the decrypt side; key bytes come from Utils.convertToByteArray on args[0].","triggerScenarios":"A key whose decoded length is outside {16,24,32}, almost always due to a format-option mismatch or a raw passphrase.","commonSituations":"Hex key with UTF8 option, UTF8 passphrase as key, or wrong-size key copied from another cipher.","solutions":["Provide a 16, 24, or 32-byte key.","Match the key format option to the key encoding.","Use a KDF to produce an allowed key length from a passphrase."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const keyBytes = Utils.convertToByteArray(key.string, key.option);\nif (![16,24,32].includes(keyBytes.length)) {\n  throw new Error(`Twofish key must be 16/24/32 bytes, got ${keyBytes.length}`);\n}","typeGuard":"function isValidTwofishKey(bytes) { return [16,24,32].includes(bytes.length); }","tryCatchPattern":null,"preventionTips":["Confirm key format option matches encoding.","Use a KDF for passphrases."],"tags":["crypto","twofish","validation","key-length","argument-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}