{"record":{"id":"e32b297a44292ca2","repo":"gchq/CyberChef","slug":"the-key-for-triple-des-must-be-16-or-24-bytes-cur","errorCode":null,"errorMessage":"The key for Triple DES must be 16 or 24 bytes (currently ${key.length} bytes)","messagePattern":"The key for Triple DES must be 16 or 24 bytes \\(currently (.+?) bytes\\)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/CMAC.mjs","lineNumber":68,"sourceCode":"    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option);\n        const algo = args[1];\n\n        const info = (function() {\n            switch (algo) {\n                case \"AES\":\n                    if (key.length !== 16 && key.length !== 24 && key.length !== 32) {\n                        throw new OperationError(\"The key for AES must be either 16, 24, or 32 bytes (currently \" + key.length + \" bytes)\");\n                    }\n                    return {\n                        \"algorithm\": \"AES-ECB\",\n                        \"key\": key,\n                        \"blockSize\": 16,\n                        \"Rb\": new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x87]),\n                    };\n                case \"Triple DES\":\n                    if (key.length !== 16 && key.length !== 24) {\n                        throw new OperationError(\"The key for Triple DES must be 16 or 24 bytes (currently \" + key.length + \" bytes)\");\n                    }\n                    return {\n                        \"algorithm\": \"3DES-ECB\",\n                        \"key\": key.length === 16 ? key + key.substring(0, 8) : key,\n                        \"blockSize\": 8,\n                        \"Rb\": new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0x1b]),\n                    };\n                default:\n                    throw new OperationError(\"Undefined encryption algorithm\");\n            }\n        })();\n\n        const xor = function(a, b, out) {\n            if (!out) out = new Uint8Array(a.length);\n            for (let i = 0; i < a.length; i++) {\n                out[i] = a[i] ^ b[i];\n            }\n            return out;","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/CMAC.mjs#L50-L86","documentation":"CMAC over Triple DES requires a 16- or 24-byte key (two-key or three-key 3DES). The operation throws when the key length is neither, because the 3DES-ECB primitive used for CMAC subkey generation would reject it.","triggerScenarios":"Calling CMAC.run with algo='Triple DES' and a key whose byte length is not 16 or 24.","commonSituations":"Supplying an 8-byte single DES key; wrong key encoding option; trailing whitespace changing length.","solutions":["Provide a 16- or 24-byte Triple DES key.","Confirm args[0].option matches the key encoding.","Note the op internally expands a 16-byte key to 24 bytes (K1||K1||K1[:8])."],"exampleFix":"// before\nkey 8 bytes\n// after\nkey 24 bytes (e.g. three distinct DES keys concatenated)","handlingStrategy":"validation","validationCode":"const keyBytes = Utils.convertToByteString(args[0].string, args[0].option);\nif (![16, 24].includes(keyBytes.length)) throw new Error('3DES-CMAC key must be 16 or 24 bytes');","typeGuard":"function is3DesKeyLen(len) { return [16, 24].includes(len); }","tryCatchPattern":null,"preventionTips":["Use a 24-byte key for full 3-key 3DES.","Confirm the key encoding option.","Remember 16-byte keys are expanded to K1||K1||K1[:8] internally."],"tags":["crypto","cmac","tripledes","key-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}