gchq/CyberChef · error · OperationError

Invalid block cipher mode: ${mode}

Error message

Invalid block cipher mode: ${mode}

What it means

Thrown by the internal encryptWithMode() helper in TEA.mjs when the `mode` argument does not match any of the handled cases (ECB, CBC, CFB, OFB, CTR). The function dispatches on a switch statement and falls into a `default` branch that rejects unknown modes. It surfaces a programmer/config error: the cipher core itself only supports those five block modes.

Source

Thrown at src/core/lib/TEA.mjs:338

                cipherText.push(...xorBlocks(ivBlock, block));
            }
            return cipherText.slice(0, messageLength);
        }

        case "CTR": {
            let counter = [...iv];
            for (let i = 0; i < data.length; i += BLOCK_SIZE) {
                const encrypted = encryptBlockFn(counter, key);
                const block = data.slice(i, i + BLOCK_SIZE);
                while (block.length < BLOCK_SIZE) block.push(0);
                cipherText.push(...xorBlocks(encrypted, block));
                counter = incrementCounter(counter);
            }
            return cipherText.slice(0, messageLength);
        }

        default:
            throw new OperationError(`Invalid block cipher mode: ${mode}`);
    }

    return cipherText;
}

/**
 * Decrypt with block cipher modes
 *
 * @param {number[]} cipherText - Ciphertext bytes
 * @param {number[]} key - 16-byte key
 * @param {number[]} iv - 8-byte IV (ignored for ECB)
 * @param {string} mode - "ECB", "CBC", "CFB", "OFB", "CTR"
 * @param {string} padding - "PKCS5", "NO", "ZERO", "RANDOM", "BIT"
 * @param {Function} encryptBlockFn - Block encrypt function (used for stream modes)
 * @param {Function} decryptBlockFn - Block decrypt function (used for ECB/CBC)
 * @returns {number[]} - Plaintext bytes
 */
function decryptWithMode(cipherText, key, iv, mode, padding, encryptBlockFn, decryptBlockFn) {

View on GitHub (pinned to 4290ea7539)

Solutions

1. Pass one of the exactly-cased supported modes: "ECB", "CBC", "CFB", "OFB", or "CTR" (uppercase, no whitespace).
2. If the value comes from user/UI input, normalise it first: mode.trim().toUpperCase(), then validate against a whitelist before calling encryptTEA/encryptXTEA.
3. If you need a mode like GCM/CCM, it is not supported by this library — pick a different cipher implementation or use CTR/CBC instead.

Example fix

// before
encryptTEA(msg, key, iv, "cbc", "PKCS5");
// after
encryptTEA(msg, key, iv, "CBC", "PKCS5");

const TEA_MODES = ["ECB", "CBC", "CFB", "OFB", "CTR"];
const safeMode = String(mode ?? "").trim().toUpperCase();
if (!TEA_MODES.includes(safeMode)) {
    throw new Error(`Unsupported TEA mode: '${mode}'. Use one of ${TEA_MODES.join(", ")}`);
}
encryptTEA(msg, key, iv, safeMode, padding);

function isTeaMode(m) {
    return typeof m === "string" &&
        ["ECB", "CBC", "CFB", "OFB", "CTR"].includes(m);
}

try {
    cipherText = encryptTEA(msg, key, iv, mode, padding);
} catch (e) {
    if (e instanceof OperationError && /Invalid block cipher mode/.test(e.message)) {
        // surface a config-level error to the user
        return { error: `Cipher mode '${mode}' is not supported by TEA.` };
    }
    throw e;
}

When it happens

Trigger: Calling encryptTEA()/encryptXTEA() with a mode string other than "ECB", "CBC", "CFB", "OFB", or "CTR". Common triggers: passing a lowercase variant ("ecb", "Cbc"), a typo ("CBC " with trailing space, "CCB"), or a mode the library does not implement (e.g. "GCM", "PCBC", "OFB8"). Also triggered by passing undefined/null which becomes the literal "undefined" string.

Common situations: Config/UI dropdown value mismatches after a refactor; copy-pasting a mode constant from another cipher library (Node crypto uses 'aes-128-cbc'); user-typed recipe input in CyberChef that is not whitelisted by the operation's option list; migration from an older API that accepted different mode names.

Related errors

• Invalid ciphertext length: ${originalLength} bytes. Must be
• Invalid block cipher mode: ${mode}
• No padding requested but input is not a ${blockSize}-byte mu
• Unknown padding type: ${padding}
• Invalid ciphertext length: ${originalLength} bytes. Must be

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/02329c02b51b195d. Report an issue: GitHub.