gchq/CyberChef · error · OperationError

Invalid IV length: ${iv.length} bytes Twofish uses an IV le

Error message

Invalid IV length: ${iv.length} bytes

Twofish uses an IV length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

Thrown by 'Twofish Decrypt' when the IV is not 16 bytes and the mode is not ECB. Twofish has a 128-bit block, so the IV must be 16 bytes. The error message also warns about Hex-vs-UTF8 type confusion.

Source

Thrown at src/core/operations/TwofishDecrypt.mjs:82

    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16 && key.length !== 24 && key.length !== 32)
            throw new OperationError(`Invalid key length: ${key.length} bytes

Twofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).`);

        if (iv.length !== 16 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

Twofish uses an IV length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        input = Utils.convertToByteArray(input, inputType);
        const output = decryptTwofish(input, key, iv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TwofishDecrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 16-byte IV (32 hex chars with Hex option).
2. Ensure the IV format option matches the IV string.
3. Switch to ECB if no IV is intended.

const ivBytes = Utils.convertToByteArray(iv.string, iv.option);
if (mode !== "ECB" && ivBytes.length !== 16) {
  throw new Error(`Twofish IV must be 16 bytes, got ${ivBytes.length}`);
}

function isValidTwofishIv(bytes, mode) { return mode === "ECB" || bytes.length === 16; }

When it happens

Trigger: Non-ECB mode with an IV whose decoded length is not 16: an 8-byte DES IV, an empty IV, or a 32-char hex IV read as UTF8 (32 bytes).

Common situations: Reusing an IV from a 64-bit-block cipher, leaving the IV blank for CBC/CFB/OFB/CTR, or a format-option mismatch.

Related errors

• Invalid IV length: ${iv.length} bytes Twofish uses an IV le
• Invalid key length: ${key.length} bytes Twofish uses a key
• Invalid key length: ${key.length} bytes Twofish uses a key
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/079776e248606f04. Report an issue: GitHub.