gchq/CyberChef · error · OperationError

Unable to decrypt input with these parameters.

Error message

Unable to decrypt input with these parameters.

What it means

Thrown by DES Decrypt run() when forge's decipher.finish() returns a falsy value, meaning node-forge could not finalize decryption. finish() returns false when padding validation fails or the total input length is not a block multiple, i.e. the ciphertext is inconsistent with the key/mode/padding. There is no more specific cause string; the error is a catch-all for 'parameters do not decrypt cleanly'.

Source

Thrown at src/core/operations/DESDecrypt.mjs:102

        input = Utils.convertToByteString(input, inputType);

        const decipher = forge.cipher.createDecipher("DES-" + mode, key);

        /* Allow for a "no padding" mode */
        if (noPadding) {
            decipher.mode.unpad = function(output, options) {
                return true;
            };
        }

        decipher.start({iv: iv});
        decipher.update(forge.util.createBuffer(input));
        const result = decipher.finish();

        if (result) {
            return outputType === "Hex" ? decipher.output.toHex() : decipher.output.getBytes();
        } else {
            throw new OperationError("Unable to decrypt input with these parameters.");
        }
    }

}

export default DESDecrypt;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the key value is the one used to encrypt (length is already validated; this is a value mismatch).
2. Confirm the Mode matches the encryption mode (CBC vs CFB vs ECB).
3. If the source was encrypted with NoPadding, select the matching 'CBC/NoPadding' or 'ECB/NoPadding' mode so finish() does not validate PKCS#7 padding.
4. Check the Input toggle (Hex vs Raw) matches the ciphertext encoding and that the decoded length is a multiple of 8 bytes.
5. Try Triple DES / AES Decrypt if the data may not be single-DES.

Example fix

// before - ciphertext encrypted with NoPadding, decrypted with CBC (padded)
Mode: CBC

// after
Mode: CBC/NoPadding

function isMultipleOf8(inputStr, inputType) {
    const b = Utils.convertToByteString(inputStr, inputType);
    return b.length % 8 === 0;
}
// note: passing this does not guarantee finish() succeeds; wrong key/mode/padding still fails

/** @returns {boolean} */
function looksLikeDesCiphertext(inputStr, inputType, mode) {
    try {
        const b = Utils.convertToByteString(inputStr, inputType);
        if (mode.substring(0, 3) === "ECB" || mode.includes("NoPadding")) {
            return b.length % 8 === 0;
        }
        return b.length % 8 === 0 && b.length >= 8;
    } catch {
        return false;
    }
}

try {
    out = desDecrypt.run(input, args);
} catch (e) {
    if (e instanceof OperationError && /Unable to decrypt/.test(e.message)) {
        // try alternate mode/padding, or prompt for the correct key
    } else throw e;
}

When it happens

Trigger: Wrong key (correct length but wrong value); wrong mode (e.g. CBC ciphertext fed to CFB); PKCS#7 padding mismatch because the data was not DES-encrypted or was encrypted with NoPadding; input ciphertext truncated or not a multiple of 8 bytes for CBC/ECB; corrupted ciphertext; wrong endianness/encoding on the Input toggle.

Common situations: Decrypting with the wrong key; ciphertext that was actually AES or 3DES; encrypted-with-NoPadding data decrypted in a padded mode (or vice versa); hex string with whitespace/non-hex chars silently truncating the input; copy-paste truncation of the ciphertext.

Related errors

• Invalid PKCS#5 padding.
• Invalid BIT padding.
• Invalid PKCS#5 padding.
• Invalid BIT padding.
• No padding requested but input is not a ${blockSize}-byte mu

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/211139d0663af113. Report an issue: GitHub.