gchq/CyberChef · error · OperationError

Input private key must be in hex; and should be 32 bytes

Error message

Input private key must be in hex; and should be 32 bytes

What it means

Thrown by SM2 Decrypt when the supplied private key string is not exactly 64 characters long. SM2 on the sm2p256v1 curve uses a 256-bit (32-byte) private key, represented here as 64 hex characters; the length check is the only validation before setPrivateKey().

Source

Thrown at src/core/operations/SM2Decrypt.mjs:59

            {
                name: "Curve",
                type: "option",
                "value": ["sm2p256v1"],
                "defaultIndex": 0
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {ArrayBuffer}
     */
    run(input, args) {
        const [privateKey, inputFormat, curveName] = args;

        if (privateKey.length !== 64) {
            throw new OperationError("Input private key must be in hex; and should be 32 bytes");
        }

        const sm2 = new SM2(curveName, inputFormat);
        sm2.setPrivateKey(privateKey);

        const result = sm2.decrypt(input);
        return result;
    }

}

export default SM2Decrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 64-character lowercase/uppercase hex string representing the 32-byte private key.
2. Strip any '0x' prefix, whitespace, and newlines from the key before passing.
3. If your key is in another format, convert it to 32-byte hex first (e.g. via the 'To Hex' operation).

Example fix

// before
sm2Decrypt.run(ciphertext, ["DEADBEEF", "C1C3C2", "sm2p256v1"])
// after
sm2Decrypt.run(ciphertext, ["164bf0eed4b1f3b7e1a1c1c7c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5", "C1C3C2", "sm2p256v1"])

function normalizePrivateKey(key) {
  let k = String(key).trim().replace(/^0x/i, "");
  if (!/^[0-9a-fA-F]{64}$/.test(k)) {
    throw new Error("Private key must be 64 hex chars (32 bytes)");
  }
  return k;
}

function isValidSm2PrivateKey(k) {
  return /^[0-9a-fA-F]{64}$/.test(String(k).trim().replace(/^0x/i, ""));
}

When it happens

Trigger: Passing a private key that is shorter/longer than 64 hex chars, includes a '0x' prefix (making it 66 chars), contains whitespace, or was copied in a different encoding. The default placeholder 'DEADBEEF' (8 chars) always triggers this.

Common situations: Leaving the default placeholder; pasting a key with a 0x prefix or newlines; supplying a base64 or raw-byte key instead of hex; truncating a key during copy-paste.

Related errors

• Invalid Public Key - Ensure each component is 32 bytes in si
• Invalid key length: ${key.length} bytes SM4 uses a key leng
• Invalid key length: ${key.length} bytes SM4 uses a key leng
• Invalid key length: ${key.length} bytes. Salsa20 uses a key
• Invalid JWK format

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/8459983784ec2701. Report an issue: GitHub.