gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes. Expected 8 bytes.

Error message

Invalid IV length: ${iv.length} bytes. Expected 8 bytes.

What it means

Blowfish is a 64-bit block cipher, so every non-ECB chaining mode requires an 8-byte initialization vector. This throws when mode is not ECB and the IV's byte length differs from 8.

Source

Thrown at src/core/operations/BlowfishDecrypt.mjs:80

     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteString(args[1].string, args[1].option),
            mode = args[2],
            inputType = args[3],
            outputType = args[4];

        if (key.length < 4 || key.length > 56) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

Blowfish's key length needs to be between 4 and 56 bytes (32-448 bits).`);
        }

        if (mode !== "ECB" && iv.length !== 8) {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes. Expected 8 bytes.`);
        }

        input = Utils.convertToByteString(input, inputType);

        const decipher = Blowfish.createDecipher(key, mode);
        decipher.start({iv: iv});
        decipher.update(forge.util.createBuffer(input));
        const result = decipher.finish();

        if (result) {
            return outputType === "Hex" ? decipher.output.toHex() : decipher.output.getBytes();
        } else {
            throw new OperationError("Unable to decrypt input with these parameters.");
        }
    }

}

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide an 8-byte IV for any mode other than ECB.
2. Confirm args[1].option matches the IV encoding (Hex/Base64/UTF8).
3. If you have no IV, switch the mode to ECB (not recommended for new designs).

Example fix

// before
mode='CBC', iv option 'Hex' with '00112233445566778899' (10 bytes)
// after
mode='CBC', iv option 'Hex' with '0011223344556677' (8 bytes)

const ivBytes = Utils.convertToByteString(args[1].string, args[1].option);
if (args[2] !== 'ECB' && ivBytes.length !== 8) {
  throw new Error('IV must be 8 bytes for non-ECB Blowfish');
}

function isValidBlowfishIV(mode, len) { return mode === 'ECB' || len === 8; }

When it happens

Trigger: Calling BlowfishDecrypt.run with mode in {CBC, CFB, OFB, CTR} (anything but ECB) and args[1] IV whose byte length is not exactly 8.

Common situations: Reusing a 16-byte AES IV by mistake; wrong IV encoding option; forgetting to supply an IV for CBC/CFB/OFB modes; pasting IV with whitespace.

Related errors

• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid IV length: ${iv.length} bytes DES uses an IV length
• Invalid IV length: ${iv.length} bytes DES uses an IV length

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/9e0c65f02fda233a. Report an issue: GitHub.