moonD4rk/HackBrowserData · error

unsupported IV length

Error message

unsupported IV length

What it means

errUnsupportedIVLen is returned by the ASN.1 PBE Decrypt/Encrypt methods when the per-algorithm branch cannot handle the derived IV length. The PBE parser supports specific IV sizes (e.g. 8-byte 3DES and 16-byte AES); anything else means the blob was parsed with wrong offsets or uses an unhandled cipher OID.

Solutions

1. Inspect the ASN.1 parameters (algorithm OID, salt and IV lengths) and add support for that cipher in the PBE switch.
2. Re-derive the parameter offsets; wrong ASN.1 field slicing produces bogus IV lengths.
3. Fall back to the documented Firefox paths (key4.db 3DES/AES-CBC) and confirm the item's encryption scheme.
4. If the blob is truly unsupported, skip it and report the OID so the case can be added upstream.

Example fix

// before
switch len(iv) {
case 8: ...
case 16: ...
default: return nil, errUnsupportedIVLen
}
// after
switch len(iv) {
case 8:  ... // 3DES
case 16: ... // AES-CBC
case 24: ... // add missing cipher handling
default: return nil, fmt.Errorf("unsupported IV len %d: %w", len(iv), errUnsupportedIVLen)
}

switch len(iv) {
case 8, 16:
    // supported
default:
    return fmt.Errorf("PBE IV len %d unsupported", len(iv))
}

plain, err := pbe.Decrypt(password)
if errors.Is(err, crypto.ErrUnsupportedIVLen) {
    return fmt.Errorf("unsupported PBE cipher (IV %d bytes): %w", len(iv), err)
}

When it happens

Trigger: NewASN1PBE succeeded but the IV carved from the ASN.1 parameters has a length not covered by the switch in decrypt/encrypt (asn1pbe.go:195/207), so the default branch returns this error.

Common situations: Firefox key4.db/logins.json items encrypted with unusual or newer PBE parameters; parsing a foreign profile whose algorithm identifiers were not produced by NSS; corrupt parameter sequences causing wrong IV slicing.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• failed to decode ASN1 data
• ciphertext is not a multiple of the block size
• ciphertext too short
• DPAPI decrypt
• invalid PKCS5 padding

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/98208aff83d742de. Report an issue: GitHub.

Appendix: source

Thrown at crypto/errors.go:12

package crypto

import "errors"

// Sentinel errors for crypto operations.
var (
	errShortCiphertext   = errors.New("ciphertext too short")
	errInvalidBlockSize  = errors.New("ciphertext is not a multiple of the block size")
	errInvalidIVLength   = errors.New("IV length must equal block size")
	errInvalidPadding    = errors.New("invalid PKCS5 padding")
	errInvalidNonceLen   = errors.New("nonce length must equal GCM nonce size")
	errUnsupportedIVLen  = errors.New("unsupported IV length")
	errDecodeASN1        = errors.New("failed to decode ASN1 data")
	errDPAPINotSupported = errors.New("DPAPI not supported on this platform") //nolint:unused // used on darwin/linux only
)

View on GitHub (pinned to 0503d04d7a)