gchq/CyberChef · error · OperationError

Invalid key length: ${key.length} bytes Twofish uses a key

Error message

Invalid key length: ${key.length} bytes

Twofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).

What it means

Thrown by 'Twofish Decrypt' when the key is not 16, 24, or 32 bytes. Twofish accepts 128/192/256-bit keys; the byte array is produced by Utils.convertToByteArray on args[0] using the chosen format option.

Source

Thrown at src/core/operations/TwofishDecrypt.mjs:77

                "name": "Padding",
                "type": "option",
                "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            iv = Utils.convertToByteArray(args[1].string, args[1].option),
            [,, mode, inputType, outputType, padding] = args;

        if (key.length !== 16 && key.length !== 24 && key.length !== 32)
            throw new OperationError(`Invalid key length: ${key.length} bytes

Twofish uses a key length of 16 bytes (128 bits), 24 bytes (192 bits), or 32 bytes (256 bits).`);

        if (iv.length !== 16 && mode !== "ECB")
            throw new OperationError(`Invalid IV length: ${iv.length} bytes

Twofish uses an IV length of 16 bytes (128 bits).
Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);

        input = Utils.convertToByteArray(input, inputType);
        const output = decryptTwofish(input, key, iv, mode, padding);
        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
    }

}

export default TwofishDecrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 16, 24, or 32-byte key.
2. Confirm the key format option matches the key encoding.
3. Derive the key from a passphrase using a KDF (e.g. PBKDF2) to hit an allowed length.

Example fix

// before: 32-char hex key read as UTF8 = 32 bytes (ok) but often mis-set
args[0] = { string: "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", option: "Hex" };

const keyBytes = Utils.convertToByteArray(key.string, key.option);
if (![16,24,32].includes(keyBytes.length)) {
  throw new Error(`Twofish key must be 16/24/32 bytes, got ${keyBytes.length}`);
}

function isValidTwofishKey(bytes) { return [16,24,32].includes(bytes.length); }

When it happens

Trigger: A key whose decoded byte length is not 16/24/32: a 3DES 24-byte key is acceptable but a 3-byte or 20-byte key fails; most commonly a format-option mismatch makes the byte length wrong.

Common situations: Hex key supplied with UTF8 option (doubles the byte count), or a UTF8 passphrase used directly as a key. Also pasting a 3DES/AES key of the wrong size.

Related errors

• Invalid key length: ${key.length} bytes Twofish uses a key
• Invalid IV length: ${iv.length} bytes Twofish uses an IV le
• Invalid IV length: ${iv.length} bytes Twofish uses an IV le
• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid key length: ${key.length} bytes Blowfish's key leng

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/bd52d217d6108188. Report an issue: GitHub.