gchq/CyberChef · error · OperationError

${err}

Error message

${err}

What it means

Fallback re-throw in GOST Key Wrap's try/catch: any crypto-gost-js error whose message lacks "Invalid typed array length" is wrapped here. Covers bad hex in key/ukm/input, a KEK that isn't 256 bits, an unsupported keyWrapping scheme, or engine construction failures.

Source

Thrown at src/core/operations/GOSTKeyWrap.mjs:136

            length: blockLength,
            mode: "KW",
            sBox: sBoxVal,
            keyWrapping: keyWrapping
        };

        try {
            const Hex = CryptoGost.coding.Hex;
            algorithm.ukm = Hex.decode(ukm);

            const cipher = GostEngine.getGostCipher(algorithm);
            const out = Hex.encode(cipher.wrapKey(Hex.decode(key), Hex.decode(input)));

            return outputType === "Hex" ? out : Utils.byteArrayToChars(fromHex(out));
        } catch (err) {
            if (err.toString().includes("Invalid typed array length")) {
                throw new OperationError("Incorrect input length. Must be a multiple of the block size.");
            }
            throw new OperationError(err);
        }
    }

}

export default GOSTKeyWrap;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 32-byte (64-hex) KEK.
2. Decode UKM to the length the wrapping scheme expects.
3. Ensure hex fields contain only hex digits.
4. Inspect the preserved `err` for the exact library message.

Example fix

// before
key = "short"; ukm = "nothex";
// after
key = "aabb...".padEnd(64,"0"); ukm = "0011223344556677";

if (hexKey.length !== 64) throw new Error("KEK must be 32 bytes / 64 hex chars");
if (!/^[0-9a-fA-F]*$/.test(ukm) || ukm.length % 2 !== 0) throw new Error("UKM must be valid hex");

function isHex(s){return typeof s==="string"&&/^[0-9a-fA-F]*$/.test(s)&&s.length%2===0;}

try { chef.bake(input, recipe); }
catch (e) { if (/hex|key|ukm|length/i.test(e.message||"")) handleUserError(e); else throw e; }

When it happens

Trigger: KEK not 32 bytes; UKM hex invalid/wrong length; non-hex characters in input; a keyWrapping value the library rejects.

Common situations: Base64 KEK pasted into Hex field; UKM length mismatch with wrapping mode; interop with non-default diversity settings.

Related errors

• ${err}
• ${err}
• ${err}
• ${err}
• Unknown algorithm version: ${version}

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/fcbe17318738497d. Report an issue: GitHub.