gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes Blowfish's key leng

Error message

Invalid key length: ${key.length} bytes

Blowfish's key length needs to be between 4 and 56 bytes (32-448 bits).

What it means

Same key-length contract as BlowfishDecrypt: the Blowfish key schedule requires 4-56 bytes (32-448 bits). BlowfishEncrypt.run throws when the converted key length falls outside that range.

Source

Thrown at src/core/operations/BlowfishEncrypt.mjs:74

                "value": ["Hex", "Raw"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteString(args[1].string, args[1].option),
            mode = args[2],
            inputType = args[3],
            outputType = args[4];

        if (key.length < 4 || key.length > 56) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

Blowfish's key length needs to be between 4 and 56 bytes (32-448 bits).`);
        }

        if (mode !== "ECB" && iv.length !== 8) {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes. Expected 8 bytes.`);
        }

        input = Utils.convertToByteString(input, inputType);

        const cipher = Blowfish.createCipher(key, mode);
        cipher.start({iv: iv});
        cipher.update(forge.util.createBuffer(input));
        cipher.finish();

        if (outputType === "Hex") {
            return cipher.output.toHex();
        } else {

View on GitHub (pinned to 4290ea7539)

Solutions

1. Ensure the key byte length is 4-56 inclusive.
2. Confirm args[0].option matches the key's encoding.
3. Strip whitespace/newlines from user-supplied keys.

Example fix

// before
key option 'UTF8' with 'abc'
// after
key option 'UTF8' with 'abcd'

const keyBytes = Utils.convertToByteString(args[0].string, args[0].option);
if (keyBytes.length < 4 || keyBytes.length > 56) throw new Error('Blowfish key out of range');

function isValidBlowfishKey(len) { return len >= 4 && len <= 56; }

When it happens

Trigger: Calling BlowfishEncrypt.run with args[0] key whose byte length is < 4 or > 56 after the args[0].option conversion.

Common situations: Short password-derived key; wrong key encoding option inflating/deflating length; trailing newline in the key string.

Related errors

• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• Invalid IV length: ${iv.length} bytes. Expected 8 bytes.
• The key for AES must be either 16, 24, or 32 bytes (currentl
• The key for Triple DES must be 16 or 24 bytes (currently ${k

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/8f498a2c61208d1f. Report an issue: GitHub.