gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes (expected: 16)

Error message

Invalid key length: ${key.length} bytes (expected: 16)

What it means

Thrown by the Rabbit stream cipher operation when the supplied key is not exactly 16 bytes (128 bits), the only key size the Rabbit algorithm supports. The key is obtained via Utils.convertToByteArray from the user's key string/option, so its byte length depends on the chosen encoding (Latin1/UTF8/Hex/Base64). If the decoded byte array is not 16 bytes long, execution stops before any cipher state is initialized.

Source

Thrown at src/core/operations/Rabbit.mjs:75

        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            endianness = args[2],
            inputType = args[3],
            outputType = args[4];

        const littleEndian = endianness === "Little";

        if (key.length !== 16) {
            throw new OperationError(`Invalid key length: ${key.length} bytes (expected: 16)`);
        }
        if (iv.length !== 0 && iv.length !== 8) {
            throw new OperationError(`Invalid IV length: ${iv.length} bytes (expected: 0 or 8)`);
        }

        // Inner State
        const X = new Uint32Array(8), C = new Uint32Array(8);
        let b = 0;

        // Counter System
        const A = [
            0x4d34d34d, 0xd34d34d3, 0x34d34d34, 0x4d34d34d,
            0xd34d34d3, 0x34d34d34, 0x4d34d34d, 0xd34d34d3
        ];
        const counterUpdate = function() {
            for (let j = 0; j < 8; j++) {
                const temp = C[j] + A[j] + b;
                b = (temp / ((1 << 30) * 4)) >>> 0;

View on GitHub (pinned to 4290ea7539)

Solutions

  1. Provide exactly 16 bytes: use a 16-character Latin1 string, a 32-character hex string, or Base64 that decodes to 16 bytes.
  2. Verify the 'Key format' option matches the encoding of your key string (Hex/Base64/Latin1/UTF8).
  3. If your key is a passphrase, hash/derive it to 16 bytes (e.g. MD5) before feeding it in, or use a KDF upstream.
  4. Count the key bytes: convert your key with the same encoding and confirm length === 16.

Example fix

// before
//   key string: "mysecretkey" (11 bytes) with format Latin1
// after
//   key string: "mysecretkey12345" (16 bytes) with format Latin1
//   or hex: "6d79736563726574 6b65793132333435" (32 hex chars -> 16 bytes)
Defensive patterns

Strategy: validation

Validate before calling

const keyBytes = Utils.convertToByteArray(keyStr, keyOption);
if (keyBytes.length !== 16) {
  throw new Error(`Key must be 16 bytes, got ${keyBytes.length}`);
}

Type guard

function isValidRabbitKey(keyBytes) { return ArrayBuffer.isView(keyBytes) && keyBytes.length === 16; }

Try / catch

try { chef.rabbit(input, { key: keyStr, iv: ivStr }); } catch (e) { if (/Invalid key length/.test(e.message)) fixKeyLength(); else throw e; }

Prevention

When it happens

Trigger: Passing a key whose decoded byte length is not 16 — e.g. a 15-byte Latin1 string, a 31-char hex string, or a Base64 string that decodes to a non-128-bit value. Also triggered by selecting the wrong key input format (Hex when the key is actually UTF-8 text).

Common situations: Mistyping the key length; mismatching the 'Key format' dropdown to the actual key encoding; copying a truncated key; assuming Rabbit accepts variable-length keys like a passphrase-derived cipher.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/c66a50f896e63923. Report an issue: GitHub.