gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes DES uses an IV length

Error message

Invalid IV length: ${iv.length} bytes

DES uses an IV length of 8 bytes (64 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

Thrown by DES Encrypt run() when the decoded IV is not 8 bytes and the mode is not ECB. Same guard and reasoning as DES Decrypt's IV check: DES block size is 64 bits, so every non-ECB mode requires an 8-byte IV. The explicit Hex-vs-UTF8 hint targets the most common misconfiguration.

Source

Thrown at src/core/operations/DESEncrypt.mjs:76

    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType] = args;

        if (key.length !== 8) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

DES uses a key length of 8 bytes (64 bits).`);
        }
        if (iv.length !== 8 && mode !== "ECB") {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

DES uses an IV length of 8 bytes (64 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
        }

        input = Utils.convertToByteString(input, inputType);

        const cipher = forge.cipher.createCipher("DES-" + mode, key);
        cipher.start({iv: iv});
        cipher.update(forge.util.createBuffer(input));
        cipher.finish();

        return outputType === "Hex" ? cipher.output.toHex() : cipher.output.getBytes();
    }

}

export default DESEncrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide an 8-byte IV (16 hex digits, 8 UTF8 chars, or ~11 Base64 chars).
2. Switch to ECB if no IV is available.
3. Confirm the IV toggle matches the encoding.
4. Generate a random 8-byte IV if the source did not specify one.

Example fix

// before
IV: 00112233445566778899aabbccddeeff   (toggle: Hex) // 16 bytes -> error

// after
IV: 0011223344556677   (toggle: Hex) // 8 bytes

function isValidDesIv(ivStr, option, mode) {
    if (mode.substring(0, 3) === "ECB") return true;
    try {
        return Utils.convertToByteArray(ivStr, option).length === 8;
    } catch {
        return false;
    }
}

/** @returns {boolean} */
function isValidDesIv(ivStr, option, mode) {
    if (mode.substring(0, 3) === "ECB") return true;
    try {
        return Utils.convertToByteArray(ivStr, option).length === 8;
    } catch {
        return false;
    }
}

try {
    out = desEncrypt.run(input, args);
} catch (e) {
    if (e instanceof OperationError && e.message.startsWith("Invalid IV length")) {
        // fix IV or use ECB
    } else throw e;
}

When it happens

Trigger: Selecting CBC/CFB/OFB/CTR with an IV whose decoded length != 8; empty IV field yielding a 0-length array; AES-length (16-byte) IV reused for DES; wrong toggle causing a halving or doubling of the expected byte count.

Common situations: IV toggle mismatch (Hex vs UTF8); empty IV expecting a default zero IV that the code does not synthesize; copying an IV from another cipher recipe; mistyping hex digits.

Related errors

• Invalid IV length: ${iv.length} bytes DES uses an IV length
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid key length: ${key.length} bytes DES uses a key leng
• Invalid key length: ${key.length} bytes DES uses a key leng

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/92134136ef99baa5. Report an issue: GitHub.