gchq/CyberChef · error · OperationError

Incorrect handshake length.

Error message

Incorrect handshake length.

What it means

After skipping version (2 bytes), JA3Fingerprint reads the 2-byte record length and requires the total stream length to equal length + 5 (5 = content type + version + length fields). A mismatch means trailing bytes (multiple records concatenated) or a truncated record. Note readInt returns undefined on exhaustion, so short input also satisfies the !== condition and throws this message.

Source

Thrown at src/core/operations/JA3Fingerprint.mjs:72

     * @returns {string}
     */
    run(input, args) {
        const [inputFormat, outputFormat] = args;

        input = Utils.convertToByteArray(input, inputFormat);
        const s = new Stream(new Uint8Array(input));

        const handshake = s.readInt(1);
        if (handshake !== 0x16)
            throw new OperationError("Not handshake data.");

        // Version
        s.moveForwardsBy(2);

        // Length
        const length = s.readInt(2);
        if (s.length !== length + 5)
            throw new OperationError("Incorrect handshake length.");

        // Handshake type
        const handshakeType = s.readInt(1);
        if (handshakeType !== 1)
            throw new OperationError("Not a Client Hello.");

        // Handshake length
        const handshakeLength = s.readInt(3);
        if (s.length !== handshakeLength + 9)
            throw new OperationError("Not enough data in Client Hello.");

        // Hello version
        const helloVersion = s.readInt(2);

        // Random
        s.moveForwardsBy(32);

        // Session ID

View on GitHub (pinned to 4290ea7539)

Solutions

1. Feed exactly one TLS record: trim trailing bytes so total === length+5.
2. Confirm the input is not truncated (the declared length fits in the buffer).
3. Match inputFormat to the real data so the length field parses correctly.
4. Split multi-record captures into individual records before this op.

Example fix

// before
ja3.run(fullStream, ['Hex','Base64']); // length+5 < total -> Incorrect handshake length.
// after
const recLen = (bytes[3]<<8)|bytes[4];
const oneRecord = bytes.slice(0, recLen + 5);
ja3.run(oneRecord, ['Hex','Base64']);

import Utils from "src/core/Utils.mjs";
function assertSingleRecord(input, inputFormat) {
  const b = Utils.convertToByteArray(input, inputFormat);
  if (b.length < 5) throw new Error('record too short');
  const recLen = (b[3] << 8) | b[4];
  if (b.length !== recLen + 5) {
    throw new Error(`Stream length ${b.length} != record length ${recLen}+5. Feed exactly one TLS record.`);
  }
  return b;
}

function isSingleTlsRecord(bytes) {
  if (bytes.length < 5) return false;
  const recLen = (bytes[3] << 8) | bytes[4];
  return bytes.length === recLen + 5;
}

When it happens

Trigger: Multiple TLS records concatenated in the input (length+5 < total), a truncated record (length+5 > total), or wrong inputFormat making the length field garbage. Feeding only part of the record also triggers it.

Common situations: Pasted the full handshake (ClientHello + ServerHello + more) instead of one record; truncated paste; inputFormat mismatch corrupting the length field.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Not handshake data.
• Not a Client Hello.
• Not enough data in Client Hello.
• Not handshake data.
• Incorrect handshake length.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/d93a35b7f4b8f3a9. Report an issue: GitHub.