gchq/CyberChef · error · OperationError

Invalid IV length: bytes TEA uses an IV length of bytes (…

Error message

Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

TEA Encrypt rejects an IV that does not decode to TEA_BLOCK_SIZE (8 bytes) for the streaming/block modes. Empty IV (defaults to null bytes) and ECB mode (no IV) bypass the check. Same guard and rationale as the decrypt path.

Solutions

Encode the IV as Hex (16 hex characters = 8 bytes) and select the Hex option.
Leave the IV blank to use the 8 null-byte default.
Use ECB mode if no IV is required.
Re-verify the byte count produced by the selected format option.

Example fix

// before: IV option = UTF8, value "12345678" -> 8 bytes ok, but "abcdefgh" Hex misread fails
// after:  IV option = Hex, value "0123456789abcdef" -> 8 bytes, passes

Defensive patterns

Strategy: validation

Validate before calling

const ivBytes = Utils.convertToByteArray(ivString, ivOption);
if (mode !== "ECB" && ivBytes.length !== 0 && ivBytes.length !== TEA_BLOCK_SIZE) {
  throw new Error(`IV must be 0 or ${TEA_BLOCK_SIZE} bytes`);
}

Type guard

function isValidTeaIv(ivBytes, mode) {
  return mode === "ECB" || ivBytes.length === 0 || ivBytes.length === 8;
}

Try / catch

try { chef.TEAEncrypt(input, [...]); }
catch (e) { if (/Invalid IV length/.test(e.message)) { /* set 8-byte IV */ } else throw e; }

Prevention

Encode the IV as Hex (16 hex digits = 8 bytes).
Leave IV empty for the null-byte default.
Verify the decoded byte length matches TEA_BLOCK_SIZE before encrypting.

When it happens

Trigger: Setting Mode to CBC/CFB/OFB/CTR with an IV toggleString that decodes to a length other than 8 bytes. Mismatching the IV format option is the usual cause, e.g. a 16-hex-character IV read as UTF8 (16 bytes) instead of Hex (8 bytes).

Common situations: Copying an IV between tools that disagree on encoding; entering ASCII IV text under a Hex option; using a 16-byte IV from AES recipes.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/533b6431bfe2a916. Report an issue: GitHub.

Appendix: source

Thrown at src/core/operations/TEAEncrypt.mjs:83

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16)
            throw new OperationError(`Invalid key length: ${key.length} bytes

TEA requires a key length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        // Default IV to null bytes if empty (like AES)
        const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;

        input = Utils.convertToByteArray(input, inputType);
        const output = encryptTEA(input, key, actualIv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TEAEncrypt;

View on GitHub (pinned to 4290ea7539)