gchq/CyberChef · error · OperationError

Invalid key length: ${keyArray.length} bytes. Ascon-Mac req

Error message

Invalid key length: ${keyArray.length} bytes.

Ascon-Mac requires a key of exactly 16 bytes (128 bits).

What it means

Thrown by AsconMAC.run when the supplied key is not exactly 16 bytes (128 bits). Ascon-Mac (the MAC profile of Ascon) fixes the key at 128 bits, so keyArray.length === 16 is enforced before AsconMac.mac is called. The key is decoded via Utils.convertToByteArray using the input option, so length is measured in bytes after decoding.

Source

Thrown at src/core/operations/AsconMAC.mjs:50

                "name": "Key",
                "type": "toggleString",
                "value": "",
                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
            }
        ];
    }

    /**
     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {string}
     * @throws {OperationError} if invalid key length
     */
    run(input, args) {
        const keyArray = Utils.convertToByteArray(args[0].string, args[0].option);

        if (keyArray.length !== 16) {
            throw new OperationError(`Invalid key length: ${keyArray.length} bytes.

Ascon-Mac requires a key of exactly 16 bytes (128 bits).`);
        }

        // Convert to Uint8Array for vendor Ascon implementation
        const keyUint8 = new Uint8Array(keyArray);
        const inputUint8 = new Uint8Array(input);

        // Compute MAC (returns Uint8Array)
        const macResult = AsconMac.mac(keyUint8, inputUint8);

        // Convert to hex string
        return toHexFast(macResult);
    }

}

export default AsconMAC;

View on GitHub (pinned to 4290ea7539)

Solutions

Provide exactly 16 bytes of key material (32 hex chars).
Derive a 16-byte key from a passphrase using a KDF before AsconMAC.
Confirm the key input option matches the encoding.

Example fix

// before
chef.asconMAC(msg, { key: "secret", keyOption: "UTF8" });

// after
chef.asconMAC(msg, { key: "00112233445566778899aabbccddeeff", keyOption: "Hex" });

Defensive patterns

Strategy: validation

Validate before calling

import Utils from "src/core/Utils.mjs";
function assertAsconMacKey(keyStr, keyOption) {
  const bytes = Utils.convertToByteArray(keyStr, keyOption);
  if (bytes.length !== 16) throw new Error(`Ascon-Mac key must be 16 bytes, got ${bytes.length}`);
  return bytes;
}
assertAsconMacKey(key, keyOption);

Type guard

function is16ByteHex(s) { return /^[0-9a-f]{32}$/i.test(s); }

Prevention

Use exactly 16 bytes (32 hex chars) for the Ascon-Mac key.
Derive keys from passphrases with a KDF.
Verify the input option matches the key encoding.

When it happens

Trigger: Supplying a key of any length other than 16 bytes: a short passphrase as UTF-8, a 32-byte key, or a hex/base64 value that decodes to != 16 bytes.

Common situations: Reusing an AES key of a different size; pasting a passphrase; miscounting the decoded byte length.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/36ac97bace77d6fb. Report an issue: GitHub.