gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes TEA requires a key

Error message

Invalid key length: ${key.length} bytes

TEA requires a key length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).

What it means

TEA Encrypt requires the key to decode to exactly 16 bytes (128 bits), the only key size the TEA algorithm supports. Any other decoded length is rejected up front because the cipher's key schedule indexes all 16 bytes via four 32-bit words.

Source

Thrown at src/core/operations/TEAEncrypt.mjs:77

                "name": "Padding",
                "type": "option",
                "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16)
            throw new OperationError(`Invalid key length: ${key.length} bytes

TEA requires a key length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        if (iv.length !== TEA_BLOCK_SIZE && iv.length !== 0 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

TEA uses an IV length of ${TEA_BLOCK_SIZE} bytes (${TEA_BLOCK_SIZE * 8} bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        // Default IV to null bytes if empty (like AES)
        const actualIv = iv.length === 0 ? new Array(TEA_BLOCK_SIZE).fill(0) : iv;

        input = Utils.convertToByteArray(input, inputType);
        const output = encryptTEA(input, key, actualIv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide the key as Hex with exactly 32 hex digits (16 bytes), e.g. 000102030405060708090a0b0c0d0e0f.
2. Or provide exactly 16 UTF8/Latin1 characters.
3. Confirm the format option matches how your key is encoded.
4. Double-check there are no stray whitespace characters in the key field.

Example fix

// before: Key = "0123456789abcdef" option Hex   -> 8 bytes, fails
// after:  Key = "0123456789abcdef0123456789abcdef" option Hex -> 16 bytes, passes

const keyBytes = Utils.convertToByteArray(keyString, keyOption);
if (keyBytes.length !== 16) {
  throw new Error(`TEA key must be 16 bytes, got ${keyBytes.length}`);
}

function isValidTeaKey(keyBytes) { return keyBytes.length === 16; }

try { chef.TEAEncrypt(input, [...]); }
catch (e) { if (/Invalid key length/.test(e.message)) { /* regenerate/extend key to 16 bytes */ } else throw e; }

When it happens

Trigger: Supplying a Key toggleString whose decoded byte length is not 16. Example: entering a 16-character ASCII passphrase as UTF8 gives 16 bytes and passes, but entering the same string as Hex decodes to 8 bytes and fails. Entering fewer/more hex characters than 32, or a Base64 string that decodes to a non-16 length, also triggers it.

Common situations: Type/option mismatch (Hex vs UTF8) on the key field; pasting a human passphrase instead of raw key bytes; reusing an AES-128 key that is 16 bytes but selecting the wrong format toggle so it decodes to a different length.

Related errors

• Invalid IV length: ${iv.length} bytes TEA uses an IV length
• Invalid IV length: ${iv.length} bytes TEA uses an IV length
• L must be non-negative
• L too large (maximum length for ${args[2]} is ${255 * HashLe
• Invalid JWK format

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/8af0146cdc9b1a78. Report an issue: GitHub.