gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes TEA uses an IV length

Error message

Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

TEA Encrypt rejects an IV that does not decode to TEA_BLOCK_SIZE (8 bytes) for the streaming/block modes. Empty IV (defaults to null bytes) and ECB mode (no IV) bypass the check. Same guard and rationale as the decrypt path.

Source

Thrown at src/core/operations/TEAEncrypt.mjs:83

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16)
            throw new OperationError(`Invalid key length: ${key.length} bytes

TEA requires a key length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        // Default IV to null bytes if empty (like AES)
        const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;

        input = Utils.convertToByteArray(input, inputType);
        const output = encryptTEA(input, key, actualIv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TEAEncrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Encode the IV as Hex (16 hex characters = 8 bytes) and select the Hex option.
2. Leave the IV blank to use the 8 null-byte default.
3. Use ECB mode if no IV is required.
4. Re-verify the byte count produced by the selected format option.

Example fix

// before: IV option = UTF8, value "12345678" -> 8 bytes ok, but "abcdefgh" Hex misread fails
// after:  IV option = Hex, value "0123456789abcdef" -> 8 bytes, passes

const ivBytes = Utils.convertToByteArray(ivString, ivOption);
if (mode !== "ECB" && ivBytes.length !== 0 && ivBytes.length !== TEA_BLOCK_SIZE) {
  throw new Error(`IV must be 0 or ${TEA_BLOCK_SIZE} bytes`);
}

function isValidTeaIv(ivBytes, mode) {
  return mode === "ECB" || ivBytes.length === 0 || ivBytes.length === 8;
}

try { chef.TEAEncrypt(input, [...]); }
catch (e) { if (/Invalid IV length/.test(e.message)) { /* set 8-byte IV */ } else throw e; }

When it happens

Trigger: Setting Mode to CBC/CFB/OFB/CTR with an IV toggleString that decodes to a length other than 8 bytes. Mismatching the IV format option is the usual cause, e.g. a 16-hex-character IV read as UTF8 (16 bytes) instead of Hex (8 bytes).

Common situations: Copying an IV between tools that disagree on encoding; entering ASCII IV text under a Hex option; using a 16-byte IV from AES recipes.

Related errors

• Invalid IV length: ${iv.length} bytes TEA uses an IV length
• Invalid key length: ${key.length} bytes TEA requires a key
• L must be non-negative
• L too large (maximum length for ${args[2]} is ${255 * HashLe
• Invalid IV length: ${iv.length} bytes SM4 uses an IV length

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/533b6431bfe2a916. Report an issue: GitHub.