grafana/k6 · info · ErrInvalidBlockSize

invalid block size

Error message

invalid block size

What it means

ErrInvalidBlockSize is returned by the PKCS#7 padding helper pKCS7Pad (internal/js/modules/k6/webcrypto/aes.go:668) when blockSize <= 0. Its only production call site (aes.go:286) passes the constant aes.BlockSize (16), so through the public crypto.subtle API this error is effectively unreachable — it is a defensive invariant guarding the internal AES-CBC encrypt path (RFC 2315 section 10.3 padding).

Source

Thrown at internal/js/modules/k6/webcrypto/aes.go:658

//
// [Web Crypto API spec]: https://www.w3.org/TR/WebCryptoAPI/#aes-gcm-encryption-operation
const maxAESGCMPlaintextLength uint64 = (1 << 39) - 256

// maxAESGcmAdditionalDataLength holds the value 2 ^ 64 - 1 as specified in
// the [Web Crypto API spec] for the AES-GCM algorithm encryption operation.
//
// [Web Crypto API spec]: https://www.w3.org/TR/WebCryptoAPI/#aes-gcm-encryption-operation
const maxAESGcmAdditionalDataLength uint64 = (1 << 64) - 1

// maxAESGcmIvLength holds the value 2 ^ 64 - 1 as specified in
// the [Web Crypto API spec] for the AES-GCM algorithm encryption operation.
//
// [Web Crypto API spec]: https://www.w3.org/TR/WebCryptoAPI/#aes-gcm-encryption-operation
const maxAESGcmIvLength uint64 = (1 << 64) - 1

var (
	// ErrInvalidBlockSize is returned when the given block size is invalid.
	ErrInvalidBlockSize = errors.New("invalid block size")

	// ErrInvalidPkcs7Data is returned when the given data is invalid.
	ErrInvalidPkcs7Data = errors.New("invalid PKCS7 data")
)

// pKCS7Padding adds PKCS7 padding to the given plaintext.
// It implements section 10.3 of [RFC 2315].
//
// [RFC 2315]: https://www.rfc-editor.org/rfc/rfc2315#section-10.3
func pKCS7Pad(plaintext []byte, blockSize int) ([]byte, error) {
	if blockSize <= 0 {
		return nil, ErrInvalidBlockSize
	}

	if len(plaintext) == 0 {
		return nil, ErrInvalidPkcs7Data
	}

View on GitHub (pinned to 93accf6570)

Solutions

1. If using a custom/forked k6, verify the AES-CBC path still passes aes.BlockSize (16)
2. Report a bug to k6 (https://github.com/grafana/k6/issues) with the script and k6 version, since stock builds cannot produce it
3. Pin a known-good k6 version while investigating

try {
  const ct = await crypto.subtle.encrypt({ name: 'AES-CBC', iv }, key, data);
} catch (e) {
  if (String(e.message).includes('invalid block size')) throw new Error('internal k6 webcrypto error — report at github.com/grafana/k6/issues');
  throw e;
}

When it happens

Trigger: Not reachable via `crypto.subtle.encrypt(...)` with AES-CBC in a normal build; would only occur from an internal regression, a patched/forked k6 that passes a different block size, or direct Go use of the helper.

Common situations: Hitting this in practice almost always means a non-standard k6 build or an internal bug introduced by custom patches — it is not a user-input error.

Related errors

• unsupported algorithm {alg}
• curve not supported for converting to ECDSA key
• unsupported algorithm: %v
• initializing the main module hasn't finished, this is a bug
• k6/experimental/webcrypto has been graduated and it's now gl

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/ce150da11dc2b21a. Report an issue: GitHub.