gchq/CyberChef · error · OperationError

Invalid nonce length: ${nonce.length} bytes. Ascon-AEAD128

Error message

Invalid nonce length: ${nonce.length} bytes.

Ascon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).

What it means

Thrown by AsconEncrypt.run when the supplied nonce is not exactly 16 bytes (128 bits). Ascon-AEAD128 uses a 128-bit nonce, so nonce.length === 16 is enforced before encryption. Nonce length is measured in decoded bytes after Utils.convertToByteArray applies the input option.

Source

Thrown at src/core/operations/AsconEncrypt.mjs:82

     * @param {Object[]} args
     * @returns {string}
     * @throws {OperationError} if invalid key or nonce length
     */
    run(input, args) {
        const key = Utils.convertToByteArray(args[0].string, args[0].option),
            nonce = Utils.convertToByteArray(args[1].string, args[1].option),
            ad = Utils.convertToByteArray(args[2].string, args[2].option),
            inputType = args[3],
            outputType = args[4];

        if (key.length !== 16) {
            throw new OperationError(`Invalid key length: ${key.length} bytes.

Ascon-AEAD128 requires a key of exactly 16 bytes (128 bits).`);
        }

        if (nonce.length !== 16) {
            throw new OperationError(`Invalid nonce length: ${nonce.length} bytes.

Ascon-AEAD128 requires a nonce of exactly 16 bytes (128 bits).`);
        }

        // Convert input to byte array
        const inputData = Utils.convertToByteArray(input, inputType);

        const keyUint8 = new Uint8Array(key);
        const nonceUint8 = new Uint8Array(nonce);
        const adUint8 = new Uint8Array(ad);
        const inputUint8 = new Uint8Array(inputData);

        // Encrypt (returns Uint8Array containing ciphertext + tag)
        const ciphertext = JsAscon.encrypt(keyUint8, nonceUint8, adUint8, inputUint8);

        // Return in requested format
        if (outputType === "Hex") {
            return toHexFast(ciphertext);

View on GitHub (pinned to 4290ea7539)

Solutions

Provide exactly 16 bytes of nonce (32 hex chars).
Generate a cryptographically random 16-byte nonce per message and transmit it alongside the ciphertext.
Confirm argument order: key then nonce.

Example fix

// before - 12-byte nonce
chef.asconEncrypt(pt, { nonce: "00112233445566778899aabb", nonceOption: "Hex" });

// after - 16-byte nonce
chef.asconEncrypt(pt, { nonce: "00112233445566778899aabbccddeeff", nonceOption: "Hex" });

Defensive patterns

Strategy: validation

Validate before calling

import Utils from "src/core/Utils.mjs";
function assertAsconNonce(nonceStr, nonceOption) {
  const bytes = Utils.convertToByteArray(nonceStr, nonceOption);
  if (bytes.length !== 16) throw new Error(`Ascon nonce must be 16 bytes, got ${bytes.length}`);
  return bytes;
}
assertAsconNonce(nonce, nonceOption);

Type guard

function is16ByteHex(s) { return /^[0-9a-f]{32}$/i.test(s); }

Prevention

Use exactly 16 bytes (32 hex chars) for the Ascon nonce.
Generate a fresh random nonce per message.
Keep key (arg[0]) and nonce (arg[1]) in the right order.

When it happens

Trigger: Supplying a 12-byte nonce, an empty nonce, a hex string of wrong length, or swapping key and nonce arguments.

Common situations: Habitual 12-byte AES-GCM nonce; short counter nonce; nonce/key argument order swapped.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/53efbb515e7323eb. Report an issue: GitHub.