gchq/CyberChef · error · OperationError

KEK must be either 16, 24, or 32 bytes (currently " + kek.le

Error message

KEK must be either 16, 24, or 32 bytes (currently " + kek.length + " bytes)

What it means

AESKeyUnwrap (RFC 3394) uses an AES Key-Encryption-Key (KEK) whose size must itself be a valid AES key size: 16, 24, or 32 bytes. The KEK length is validated before any unwrap work. This mirrors the standard AES key-size constraint because the KEK drives an AES-ECB cipher.

Source

Thrown at src/core/operations/AESKeyUnwrap.mjs:68

                "type": "option",
                "value": ["Hex", "Raw"]
            },
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        const kek = Utils.convertToByteString(args[0].string, args[0].option),
            iv = Utils.convertToByteString(args[1].string, args[1].option),
            inputType = args[2],
            outputType = args[3];

        if (kek.length !== 16 && kek.length !== 24 && kek.length !== 32) {
            throw new OperationError("KEK must be either 16, 24, or 32 bytes (currently " + kek.length + " bytes)");
        }
        if (iv.length !== 8) {
            throw new OperationError("IV must be 8 bytes (currently " + iv.length + " bytes)");
        }
        const inputData = Utils.convertToByteString(input, inputType);
        if (inputData.length % 8 !== 0 || inputData.length < 24) {
            throw new OperationError("input must be 8n (n>=3) bytes (currently " + inputData.length + " bytes)");
        }

        const cipher = forge.cipher.createCipher("AES-ECB", kek);
        cipher.start();
        cipher.update(forge.util.createBuffer(""));
        cipher.finish();
        const paddingBlock = cipher.output.getBytes();

        const decipher = forge.cipher.createDecipher("AES-ECB", kek);

        let A = inputData.substring(0, 8);

View on GitHub (pinned to 4290ea7539)

Solutions

  1. Set the KEK format option to match its representation (Hex/Base64/UTF8).
  2. Confirm the KEK byte length is exactly 16, 24, or 32.
  3. Derive the KEK via a KDF that outputs a fixed 16/24/32-byte length.

Example fix

// before: KEK "a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6a6" (hex) with format UTF8 → 32 bytes
// after: set KEK format to "Hex" → 16 bytes
Defensive patterns

Strategy: validation

Validate before calling

function validateKek(kekBytes) {
  if (![16, 24, 32].includes(kekBytes.length)) {
    throw new Error(`KEK must be 16/24/32 bytes, got ${kekBytes.length}`);
  }
}

Type guard

function isAesKek(bytes) { return bytes instanceof Uint8Array && [16, 24, 32].includes(bytes.length); }

Try / catch

try { aesKeyUnwrap(...); } catch (e) { if (/KEK must be/.test(e.message)) {/* fix KEK format/length */} else throw e; }

Prevention

When it happens

Trigger: args[0] converted to a byte string yields a length other than 16, 24, or 32. Usually a Key Format mismatch (Hex/UTF8/Base64) on the KEK field, or a passphrase used directly.

Common situations: KEK supplied as hex but the format option left on UTF8 (doubling/halving the byte count); KEK from a different system that was truncated; using a derived key whose output length was not pinned to 16/24/32.

Related errors

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/cef41167f827b71b. Report an issue: GitHub.