gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes Twofish uses a key

Error message

Invalid key length: ${key.length} bytes

Twofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).

What it means

Thrown by 'Twofish Encrypt' when the key is not 16, 24, or 32 bytes. Same length set as the decrypt side; key bytes come from Utils.convertToByteArray on args[0].

Source

Thrown at src/core/operations/TwofishEncrypt.mjs:77

                "name": "Padding",
                "type": "option",
                "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16 && key.length !== 24 && key.length !== 32)
            throw new OperationError(`Invalid key length: ${key.length} bytes

Twofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).`);

        if (iv.length !== 16 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

Twofish uses an IV length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        input = Utils.convertToByteArray(input, inputType);
        const output = encryptTwofish(input, key, iv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TwofishEncrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 16, 24, or 32-byte key.
2. Match the key format option to the key encoding.
3. Use a KDF to produce an allowed key length from a passphrase.

const keyBytes = Utils.convertToByteArray(key.string, key.option);
if (![16,24,32].includes(keyBytes.length)) {
  throw new Error(`Twofish key must be 16/24/32 bytes, got ${keyBytes.length}`);
}

function isValidTwofishKey(bytes) { return [16,24,32].includes(bytes.length); }

When it happens

Trigger: A key whose decoded length is outside {16,24,32}, almost always due to a format-option mismatch or a raw passphrase.

Common situations: Hex key with UTF8 option, UTF8 passphrase as key, or wrong-size key copied from another cipher.

Related errors

• Invalid key length: ${key.length} bytes Twofish uses a key
• Invalid IV length: ${iv.length} bytes Twofish uses an IV le
• Invalid IV length: ${iv.length} bytes Twofish uses an IV le
• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid key length: ${key.length} bytes Blowfish's key leng

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/dd0b76e5657f5291. Report an issue: GitHub.