gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes TEA uses an IV length

Error message

Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

TEA Decrypt rejects an Initialisation Vector whose byte length does not equal TEA_BLOCK_SIZE (8 bytes / 64 bits). The check is skipped only when the IV is empty (it then defaults to null bytes) or when ECB mode is selected (ECB uses no IV). The error is thrown before any decryption runs, because an IV of the wrong width cannot seed the CBC/CFB/OFB/CTR feedback registers.

Source

Thrown at src/core/operations/TEADecrypt.mjs:83

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16)
            throw new OperationError(`Invalid key length: ${key.length} bytes

TEA requires a key length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        // Default IV to null bytes if empty (like AES)
        const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;

        input = Utils.convertToByteArray(input, inputType);
        const output = decryptTEA(input, key, actualIv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TEADecrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

Set the IV option to Hex and enter exactly 16 hex characters (8 bytes), e.g. 0123456789abcdef.
Or leave the IV field empty so it defaults to 8 null bytes.
Or switch Mode to ECB if your ciphertext was encrypted without an IV.
Verify the byte length after decoding: the IV string under the chosen option must convert to exactly 8 bytes.

Example fix

// before: IV = "0123456789abcdef" with option UTF8  -> 16 bytes, fails
// after:  IV = "0123456789abcdef" with option Hex   -> 8 bytes, passes

Defensive patterns

Strategy: validation

Validate before calling

const ivBytes = Utils.convertToByteArray(ivString, ivOption);
if (mode !== "ECB" && ivBytes.length !== 0 && ivBytes.length !== TEA_BLOCK_SIZE) {
  throw new Error(`IV must be 0 or ${TEA_BLOCK_SIZE} bytes, got ${ivBytes.length}`);
}

Type guard

function isValidTeaIv(ivBytes, mode) {
  return mode === "ECB" || ivBytes.length === 0 || ivBytes.length === 8;
}

Try / catch

try { chef.TEADecrypt(input, [{string: key, option: "Hex"}, {string: iv, option: "Hex"}, "CBC", "Hex", "Raw", "PKCS5"]); }
catch (e) { if (/Invalid IV length/.test(e.message)) { /* fix IV to 8 bytes */ } else throw e; }

Prevention

Always provide the IV as Hex with 16 hex digits.
Use the same format option consistently for key and IV.
Leave the IV blank to accept the null-byte default.
Prefer ECB only when you know no IV was used.

When it happens

Trigger: Supplying an IV via a toggleString argument that decodes to a length other than 8 bytes while Mode is CBC, CFB, OFB, or CTR. A typical cause is entering the IV as UTF8 text of the wrong length, or as Hex whose decoded length is not 8 (e.g. 16 hex chars = 8 bytes is correct; 8 hex chars = 4 bytes fails).

Common situations: Confusing Hex and UTF8 for the IV field (typing 8 ASCII characters as UTF8 yields 8 bytes but typing them as Hex yields 4 bytes); pasting an AES 16-byte IV into a TEA recipe; copying an IV from a tool that uses a different block size.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/c78eeed395af3a1f. Report an issue: GitHub.