gchq/CyberChef · error · OperationError

Invalid key length: bytes. Ascon-Mac requires a key of…

Error message

Invalid key length: ${keyArray.length} bytes.

Ascon-Mac requires a key of exactly 16 bytes (128 bits).

What it means

Thrown by AsconMAC.run when the supplied key is not exactly 16 bytes (128 bits). Ascon-Mac (the MAC profile of Ascon) fixes the key at 128 bits, so keyArray.length === 16 is enforced before AsconMac.mac is called. The key is decoded via Utils.convertToByteArray using the input option, so length is measured in bytes after decoding.

Solutions

Provide exactly 16 bytes of key material (32 hex chars).
Derive a 16-byte key from a passphrase using a KDF before AsconMAC.
Confirm the key input option matches the encoding.

Example fix

// before
chef.asconMAC(msg, { key: "secret", keyOption: "UTF8" });

// after
chef.asconMAC(msg, { key: "00112233445566778899aabbccddeeff", keyOption: "Hex" });

Defensive patterns

Strategy: validation

Validate before calling

import Utils from "src/core/Utils.mjs";
function assertAsconMacKey(keyStr, keyOption) {
  const bytes = Utils.convertToByteArray(keyStr, keyOption);
  if (bytes.length !== 16) throw new Error(`Ascon-Mac key must be 16 bytes, got ${bytes.length}`);
  return bytes;
}
assertAsconMacKey(key, keyOption);

Type guard

function is16ByteHex(s) { return /^[0-9a-f]{32}$/i.test(s); }

Prevention

Use exactly 16 bytes (32 hex chars) for the Ascon-Mac key.
Derive keys from passphrases with a KDF.
Verify the input option matches the key encoding.

When it happens

Trigger: Supplying a key of any length other than 16 bytes: a short passphrase as UTF-8, a 32-byte key, or a hex/base64 value that decodes to != 16 bytes.

Common situations: Reusing an AES key of a different size; pasting a passphrase; miscounting the decoded byte length.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/36ac97bace77d6fb. Report an issue: GitHub.

Appendix: source

Thrown at src/core/operations/AsconMAC.mjs:50

                "name": "Key",
                "type": "toggleString",
                "value": "",
                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
            }
        ];
    }

    /**
     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {string}
     * @throws {OperationError} if invalid key length
     */
    run(input, args) {
        const keyArray = Utils.convertToByteArray(args[0].string, args[0].option);

        if (keyArray.length !== 16) {
            throw new OperationError(`Invalid key length: ${keyArray.length} bytes.

Ascon-Mac requires a key of exactly 16 bytes (128 bits).`);
        }

        // Convert to Uint8Array for vendor Ascon implementation
        const keyUint8 = new Uint8Array(keyArray);
        const inputUint8 = new Uint8Array(input);

        // Compute MAC (returns Uint8Array)
        const macResult = AsconMac.mac(keyUint8, inputUint8);

        // Convert to hex string
        return toHexFast(macResult);
    }

}

export default AsconMAC;

View on GitHub (pinned to 4290ea7539)