gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes DES uses an IV length

Error message

Invalid IV length: ${iv.length} bytes

DES uses an IV length of 8 bytes (64 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

Thrown by DES Decrypt run() when the IV, decoded via Utils.convertToByteArray, is not 8 bytes long AND the cipher mode is not ECB (ECB needs no IV and is exempt). DES block size is 64 bits so all chained modes require an 8-byte IV. The guard sits before createDecipher, giving a clearer error than forge would. The hint about Hex vs UTF8 reflects the most frequent cause.

Source

Thrown at src/core/operations/DESDecrypt.mjs:78

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            mode = args[2].substring(0, 3),
            noPadding = args[2].endsWith("NoPadding"),
            [,,, inputType, outputType] = args;

        if (key.length !== 8) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

DES uses a key length of 8 bytes (64 bits).`);
        }
        if (iv.length !== 8 && mode !== "ECB") {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

DES uses an IV length of 8 bytes (64 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
        }

        input = Utils.convertToByteString(input, inputType);

        const decipher = forge.cipher.createDecipher("DES-" + mode, key);

        /* Allow for a "no padding" mode */
        if (noPadding) {
            decipher.mode.unpad = function(output, options) {
                return true;
            };
        }

        decipher.start({iv: iv});
        decipher.update(forge.util.createBuffer(input));

View on GitHub (pinned to 4290ea7539)

Solutions

1. Supply an 8-byte IV: 16 hex digits (Hex), 8 ASCII chars (UTF8/Latin1), or ~11 Base64 chars.
2. For ECB mode, ensure the Mode selector is exactly 'ECB' (substring(0,3)==='ECB') so the IV check is skipped.
3. Re-verify the IV toggle matches the encoding of the value.
4. If you genuinely have no IV, switch to ECB or generate a random 8-byte IV.

Example fix

// before - wrong toggle
IV: 12345678   (toggle: Hex)   // 4 bytes -> error

// after
IV: 12345678   (toggle: UTF8) // 8 bytes
// or
IV: 0102030405060708   (toggle: Hex) // 8 bytes

function desIvOrSkip(ivStr, option, mode) {
    if (mode === "ECB") return true;
    const iv = Utils.convertToByteArray(ivStr, option);
    return iv.length === 8;
}

/** @returns {boolean} */
function isValidDesIv(ivStr, option, mode) {
    if (mode.substring(0, 3) === "ECB") return true;
    try {
        return Utils.convertToByteArray(ivStr, option).length === 8;
    } catch {
        return false;
    }
}

try {
    out = desDecrypt.run(input, args);
} catch (e) {
    if (e instanceof OperationError && e.message.startsWith("Invalid IV length")) {
        // fix IV encoding or switch to ECB
    } else throw e;
}

When it happens

Trigger: Selecting CBC/CFB/OFB/CTR mode with an IV whose decoded length != 8. Common: 8 ASCII chars selected as 'Hex' decode to 4 bytes; an empty IV field (convertToByteArray returns [] length 0); a 16-hex-digit IV intended for AES mistakenly reused for DES.

Common situations: Wrong IV format toggle (Hex vs UTF8 vs Base64) yielding wrong byte count; empty IV expecting a default but the code does not auto-zero-pad; copying an AES IV (16 bytes) into a DES recipe; mistyping the IV.

Related errors

• Invalid IV length: ${iv.length} bytes DES uses an IV length
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid key length: ${key.length} bytes DES uses a key leng
• Invalid key length: ${key.length} bytes DES uses a key leng

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/f9a261abd9532a44. Report an issue: GitHub.