{"record":{"id":"f9a261abd9532a44","repo":"gchq/CyberChef","slug":"invalid-iv-length-iv-length-bytes-des-uses-an","errorCode":null,"errorMessage":"Invalid IV length: ${iv.length} bytes\n\nDES uses an IV length of 8 bytes (64 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).","messagePattern":"Invalid IV length: (.+?) bytes\n\nDES uses an IV length of 8 bytes \\(64 bits\\)\\.\nMake sure you have specified the type correctly \\(e\\.g\\. Hex vs UTF8\\)\\.","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/DESDecrypt.mjs","lineNumber":78,"sourceCode":"    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        const key = Utils.convertToByteString(args[0].string, args[0].option),\n            iv = Utils.convertToByteArray(args[1].string, args[1].option),\n            mode = args[2].substring(0, 3),\n            noPadding = args[2].endsWith(\"NoPadding\"),\n            [,,, inputType, outputType] = args;\n\n        if (key.length !== 8) {\n            throw new OperationError(`Invalid key length: ${key.length} bytes\n\nDES uses a key length of 8 bytes (64 bits).`);\n        }\n        if (iv.length !== 8 && mode !== \"ECB\") {\n            throw new OperationError(`Invalid IV length: ${iv.length} bytes\n\nDES uses an IV length of 8 bytes (64 bits).\nMake sure you have specified the type correctly (e.g. Hex vs UTF8).`);\n        }\n\n        input = Utils.convertToByteString(input, inputType);\n\n        const decipher = forge.cipher.createDecipher(\"DES-\" + mode, key);\n\n        /* Allow for a \"no padding\" mode */\n        if (noPadding) {\n            decipher.mode.unpad = function(output, options) {\n                return true;\n            };\n        }\n\n        decipher.start({iv: iv});\n        decipher.update(forge.util.createBuffer(input));","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/DESDecrypt.mjs#L60-L96","documentation":"Thrown by DES Decrypt run() when the IV, decoded via Utils.convertToByteArray, is not 8 bytes long AND the cipher mode is not ECB (ECB needs no IV and is exempt). DES block size is 64 bits so all chained modes require an 8-byte IV. The guard sits before createDecipher, giving a clearer error than forge would. The hint about Hex vs UTF8 reflects the most frequent cause.","triggerScenarios":"Selecting CBC/CFB/OFB/CTR mode with an IV whose decoded length != 8. Common: 8 ASCII chars selected as 'Hex' decode to 4 bytes; an empty IV field (convertToByteArray returns [] length 0); a 16-hex-digit IV intended for AES mistakenly reused for DES.","commonSituations":"Wrong IV format toggle (Hex vs UTF8 vs Base64) yielding wrong byte count; empty IV expecting a default but the code does not auto-zero-pad; copying an AES IV (16 bytes) into a DES recipe; mistyping the IV.","solutions":["Supply an 8-byte IV: 16 hex digits (Hex), 8 ASCII chars (UTF8/Latin1), or ~11 Base64 chars.","For ECB mode, ensure the Mode selector is exactly 'ECB' (substring(0,3)==='ECB') so the IV check is skipped.","Re-verify the IV toggle matches the encoding of the value.","If you genuinely have no IV, switch to ECB or generate a random 8-byte IV."],"exampleFix":"// before - wrong toggle\nIV: 12345678   (toggle: Hex)   // 4 bytes -> error\n\n// after\nIV: 12345678   (toggle: UTF8) // 8 bytes\n// or\nIV: 0102030405060708   (toggle: Hex) // 8 bytes","handlingStrategy":"validation","validationCode":"function desIvOrSkip(ivStr, option, mode) {\n    if (mode === \"ECB\") return true;\n    const iv = Utils.convertToByteArray(ivStr, option);\n    return iv.length === 8;\n}","typeGuard":"/** @returns {boolean} */\nfunction isValidDesIv(ivStr, option, mode) {\n    if (mode.substring(0, 3) === \"ECB\") return true;\n    try {\n        return Utils.convertToByteArray(ivStr, option).length === 8;\n    } catch {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    out = desDecrypt.run(input, args);\n} catch (e) {\n    if (e instanceof OperationError && e.message.startsWith(\"Invalid IV length\")) {\n        // fix IV encoding or switch to ECB\n    } else throw e;\n}","preventionTips":["Supply an 8-byte IV for any non-ECB DES mode.","Double-check the IV toggle matches the value encoding.","Use ECB only when no IV is available (and accept its security trade-offs).","Do not reuse an AES-length (16-byte) IV for DES."],"tags":["crypto","des","iv-length","validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}