gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes DES uses a key leng

Error message

Invalid key length: ${key.length} bytes

DES uses a key length of 8 bytes (64 bits).

What it means

Thrown by DES Encrypt run() when the supplied key, decoded via Utils.convertToByteString, is not exactly 8 bytes. Identical semantics to DES Decrypt's key check: DES uses a fixed 64-bit key, and this guard runs before forge's createCipher. Encryption is deterministic given a valid key, so this is purely a length/format problem, not a value problem.

Source

Thrown at src/core/operations/DESEncrypt.mjs:71

                "name": "Output",
                "type": "option",
                "value": ["Hex", "Raw"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType] = args;

        if (key.length !== 8) {
            throw new OperationError(`Invalid key length: ${key.length} bytes

DES uses a key length of 8 bytes (64 bits).`);
        }
        if (iv.length !== 8 && mode !== "ECB") {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

DES uses an IV length of 8 bytes (64 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
        }

        input = Utils.convertToByteString(input, inputType);

        const cipher = forge.cipher.createCipher("DES-" + mode, key);
        cipher.start({iv: iv});
        cipher.update(forge.util.createBuffer(input));
        cipher.finish();

        return outputType === "Hex" ? cipher.output.toHex() : cipher.output.getBytes();

View on GitHub (pinned to 4290ea7539)

Solutions

Provide an 8-byte key in the encoding matching the toggle (16 hex digits, 8 UTF8 chars, etc.).
Re-check the Key toggle against the key's encoding.
If you need to use a passphrase, hash it first (e.g. MD5 then truncate to 8 bytes) or switch to a passphrase-based KDF recipe.
Validate byte length with a From Hex/From Base64 op before the DES Encrypt.

Example fix

// before
Key: mySecretKey   (toggle: UTF8)  // 11 bytes -> error

// after
Key: 6d795365637265744b657921   (toggle: Hex) // choose 16 hex = 8 bytes
// or trim to 8 UTF8 chars

Defensive patterns

Strategy: validation

Validate before calling

function desKeyBytes(keyStr, option) {
    const key = Utils.convertToByteString(keyStr, option);
    return key.length === 8 ? key : null;
}

Type guard

/** @returns {boolean} */
function isValidDesKey(keyStr, option) {
    try {
        return Utils.convertToByteString(keyStr, option).length === 8;
    } catch {
        return false;
    }
}

Try / catch

try {
    out = desEncrypt.run(input, args);
} catch (e) {
    if (e instanceof OperationError && e.message.startsWith("Invalid key length")) {
        // fix key/encoding
    } else throw e;
}

Prevention

Provide exactly 8 bytes for the DES key in the matching encoding.
Hash long passphrases before using them as a DES key.
Verify hex keys are 16 digits, UTF8 keys are 8 chars.
Validate with a From Hex/From Base64 op first.

When it happens

Trigger: Key argument whose decoded byte length != 8 under the selected toggle (Hex/UTF8/Latin1/Base64). Examples: 'password' in UTF8 is 8 bytes (valid); 'pass' in UTF8 is 4 bytes (fails); '0123456789abcdef' is 8 bytes in Hex but 16 in UTF8.

Common situations: Mismatched key toggle (Hex vs UTF8); pasting a human-readable passphrase and expecting it to be hashed (DES takes the raw key, not a derived one); reusing an AES key; typo in hex (odd-length hex silently produces wrong byte count upstream).

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/c346ba8a91b7ccf6. Report an issue: GitHub.