moonD4rk/HackBrowserData · error

unsupported IV length

Error message

unsupported IV length

What it means

errUnsupportedIVLen is returned by the ASN.1 PBE Decrypt/Encrypt methods when the per-algorithm branch cannot handle the derived IV length. The PBE parser supports specific IV sizes (e.g. 8-byte 3DES and 16-byte AES); anything else means the blob was parsed with wrong offsets or uses an unhandled cipher OID.

Source

Thrown at crypto/errors.go:12

package crypto

import "errors"

// Sentinel errors for crypto operations.
var (
	errShortCiphertext   = errors.New("ciphertext too short")
	errInvalidBlockSize  = errors.New("ciphertext is not a multiple of the block size")
	errInvalidIVLength   = errors.New("IV length must equal block size")
	errInvalidPadding    = errors.New("invalid PKCS5 padding")
	errInvalidNonceLen   = errors.New("nonce length must equal GCM nonce size")
	errUnsupportedIVLen  = errors.New("unsupported IV length")
	errDecodeASN1        = errors.New("failed to decode ASN1 data")
	errDPAPINotSupported = errors.New("DPAPI not supported on this platform") //nolint:unused // used on darwin/linux only
)

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Inspect the ASN.1 parameters (algorithm OID, salt and IV lengths) and add support for that cipher in the PBE switch.
2. Re-derive the parameter offsets; wrong ASN.1 field slicing produces bogus IV lengths.
3. Fall back to the documented Firefox paths (key4.db 3DES/AES-CBC) and confirm the item's encryption scheme.
4. If the blob is truly unsupported, skip it and report the OID so the case can be added upstream.

Example fix

// before
switch len(iv) {
case 8: ...
case 16: ...
default: return nil, errUnsupportedIVLen
}
// after
switch len(iv) {
case 8:  ... // 3DES
case 16: ... // AES-CBC
case 24: ... // add missing cipher handling
default: return nil, fmt.Errorf("unsupported IV len %d: %w", len(iv), errUnsupportedIVLen)
}

switch len(iv) {
case 8, 16:
    // supported
default:
    return fmt.Errorf("PBE IV len %d unsupported", len(iv))
}

plain, err := pbe.Decrypt(password)
if errors.Is(err, crypto.ErrUnsupportedIVLen) {
    return fmt.Errorf("unsupported PBE cipher (IV %d bytes): %w", len(iv), err)
}

When it happens

Trigger: NewASN1PBE succeeded but the IV carved from the ASN.1 parameters has a length not covered by the switch in decrypt/encrypt (asn1pbe.go:195/207), so the default branch returns this error.

Common situations: Firefox key4.db/logins.json items encrypted with unusual or newer PBE parameters; parsing a foreign profile whose algorithm identifiers were not produced by NSS; corrupt parameter sequences causing wrong IV slicing.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• failed to decode ASN1 data
• ciphertext too short
• ciphertext is not a multiple of the block size
• invalid PKCS5 padding
• nonce length must equal GCM nonce size

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/98208aff83d742de. Report an issue: GitHub.