gchq/CyberChef · error · OperationError

Invalid Public Key - Ensure each component is 32 bytes in si

Error message

Invalid Public Key - Ensure each component is 32 bytes in size and in hex

What it means

Thrown by SM2 Encrypt when either the public key X or Y component is not exactly 64 characters. SM2 public keys are an (X, Y) point on sm2p256v1, each coordinate being 256 bits = 32 bytes = 64 hex chars. The check runs before setPublicKey().

Source

Thrown at src/core/operations/SM2Encrypt.mjs:66

                name: "Curve",
                type: "option",
                "value": ["sm2p256v1"],
                "defaultIndex": 0
            }
        ];
    }

    /**
     * @param {ArrayBuffer} input
     * @param {Object[]} args
     * @returns {byteArray}
     */
    run(input, args) {
        const [publicKeyX, publicKeyY, outputFormat, curveName] = args;
        this.outputFormat = outputFormat;

        if (publicKeyX.length !== 64 || publicKeyY.length !== 64) {
            throw new OperationError("Invalid Public Key - Ensure each component is 32 bytes in size and in hex");
        }

        const sm2 = new SM2(curveName, outputFormat);
        sm2.setPublicKey(publicKeyX, publicKeyY);

        const result = sm2.encrypt(new Uint8Array(input));
        return result;
    }
}

export default SM2Encrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Split the uncompressed public key (04 || X || Y) into two separate 64-char hex strings for X and Y.
2. Remove any '0x' prefix, '04' prefix, whitespace, and newlines.
3. Verify both publicKeyX.length === 64 and publicKeyY.length === 64 before calling.

Example fix

// before
sm2Encrypt.run(buf, ["DEADBEEF", "DEADBEEF", "C1C3C2", "sm2p256v1"])
// after
sm2Encrypt.run(buf, ["<64 hex X>", "<64 hex Y>", "C1C3C2", "sm2p256v1"])

function splitSm2PublicKey(full) {
  const hex = String(full).trim().replace(/^04/, "").replace(/\s+/g, "");
  if (hex.length !== 128) throw new Error("Uncompressed key must be 04 + X + Y (130 hex chars)");
  return [hex.slice(0, 64), hex.slice(64, 128)];
}
function assertCoord(name, v) {
  if (!/^[0-9a-fA-F]{64}$/.test(v)) throw new Error(`${name} must be 64 hex chars`);
}

function isValidSm2PublicKey(x, y) {
  return /^[0-9a-fA-F]{64}$/.test(x) && /^[0-9a-fA-F]{64}$/.test(y);
}

When it happens

Trigger: Passing publicKeyX or publicKeyY with length != 64 — including the default placeholder 'DEADBEEF' (8 chars), keys with '0x' prefixes, uncompressed '04'||X||Y format (129 chars total), or whitespace-padded values.

Common situations: Leaving the default placeholders; pasting the full uncompressed public key (04-prefixed) into one field instead of splitting X and Y; copying only one coordinate; non-hex characters.

Related errors

• Input private key must be in hex; and should be 32 bytes
• Invalid key length: ${key.length} bytes SM4 uses a key leng
• Invalid key length: ${key.length} bytes SM4 uses a key leng
• Invalid key length: ${key.length} bytes. Salsa20 uses a key
• Invalid JWK format

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/bde9f9e52955cf5f. Report an issue: GitHub.