gchq/CyberChef · error · OperationError

The key for Triple DES must be 16 or 24 bytes (currently ${k

Error message

The key for Triple DES must be 16 or 24 bytes (currently ${key.length} bytes)

What it means

CMAC over Triple DES requires a 16- or 24-byte key (two-key or three-key 3DES). The operation throws when the key length is neither, because the 3DES-ECB primitive used for CMAC subkey generation would reject it.

Source

Thrown at src/core/operations/CMAC.mjs:68

    run(input, args) {
        const key = Utils.convertToByteString(args[0].string, args[0].option);
        const algo = args[1];

        const info = (function() {
            switch (algo) {
                case "AES":
                    if (key.length !== 16 && key.length !== 24 && key.length !== 32) {
                        throw new OperationError("The key for AES must be either 16, 24, or 32 bytes (currently " + key.length + " bytes)");
                    }
                    return {
                        "algorithm": "AES-ECB",
                        "key": key,
                        "blockSize": 16,
                        "Rb": new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x87]),
                    };
                case "Triple DES":
                    if (key.length !== 16 && key.length !== 24) {
                        throw new OperationError("The key for Triple DES must be 16 or 24 bytes (currently " + key.length + " bytes)");
                    }
                    return {
                        "algorithm": "3DES-ECB",
                        "key": key.length === 16 ? key + key.substring(0, 8) : key,
                        "blockSize": 8,
                        "Rb": new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0x1b]),
                    };
                default:
                    throw new OperationError("Undefined encryption algorithm");
            }
        })();

        const xor = function(a, b, out) {
            if (!out) out = new Uint8Array(a.length);
            for (let i = 0; i < a.length; i++) {
                out[i] = a[i] ^ b[i];
            }
            return out;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Provide a 16- or 24-byte Triple DES key.
2. Confirm args[0].option matches the key encoding.
3. Note the op internally expands a 16-byte key to 24 bytes (K1||K1||K1[:8]).

Example fix

// before
key 8 bytes
// after
key 24 bytes (e.g. three distinct DES keys concatenated)

const keyBytes = Utils.convertToByteString(args[0].string, args[0].option);
if (![16, 24].includes(keyBytes.length)) throw new Error('3DES-CMAC key must be 16 or 24 bytes');

function is3DesKeyLen(len) { return [16, 24].includes(len); }

When it happens

Trigger: Calling CMAC.run with algo='Triple DES' and a key whose byte length is not 16 or 24.

Common situations: Supplying an 8-byte single DES key; wrong key encoding option; trailing whitespace changing length.

Related errors

• The key for AES must be either 16, 24, or 32 bytes (currentl
• Invalid key length: ${key.length} bytes Blowfish's key leng
• Invalid key length: ${key.length} bytes Blowfish's key leng
• Undefined encryption algorithm
• Invalid key length: ${key.length} bytes DES uses a key leng

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/e32b297a44292ca2. Report an issue: GitHub.