gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes Twofish uses an IV le

Error message

Invalid IV length: ${iv.length} bytes

Twofish uses an IV length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

Thrown by 'Twofish Encrypt' when the IV is not 16 bytes and mode is not ECB. Twofish's 128-bit block dictates a 16-byte IV; the message flags the common Hex-vs-UTF8 mistake.

Source

Thrown at src/core/operations/TwofishEncrypt.mjs:82

    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16 && key.length !== 24 && key.length !== 32)
            throw new OperationError(`Invalid key length: ${key.length} bytes

Twofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).`);

        if (iv.length !== 16 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

Twofish uses an IV length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        input = Utils.convertToByteArray(input, inputType);
        const output = encryptTwofish(input, key, iv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TwofishEncrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 16-byte IV.
2. Verify the IV format option.
3. Use ECB if you intend no IV.

const ivBytes = Utils.convertToByteArray(iv.string, iv.option);
if (mode !== "ECB" && ivBytes.length !== 16) {
  throw new Error(`Twofish IV must be 16 bytes, got ${ivBytes.length}`);
}

function isValidTwofishIv(bytes, mode) { return mode === "ECB" || bytes.length === 16; }

When it happens

Trigger: Non-ECB mode with a non-16-byte IV: e.g. an 8-byte IV, empty IV, or a 32-char hex IV read as UTF8.

Common situations: Format option mismatch, reusing a DES/3DES IV, or omitting the IV for a chaining mode.

Related errors

• Invalid IV length: ${iv.length} bytes Twofish uses an IV le
• Invalid key length: ${key.length} bytes Twofish uses a key
• Invalid key length: ${key.length} bytes Twofish uses a key
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/75c47ddc501323b9. Report an issue: GitHub.