w7corp/easywechat · error · InvalidArgumentException

$blockSize may not be more than 32 bytes(256 bits)

Error message

$blockSize may not be more than 32 bytes(256 bits)

What it means

Pkcs7::padding rejects a blockSize larger than 32 bytes (256 bits). Internally Encryptor::encryptAsArray (src/Kernel/Encryptor.php:141) passes blockSize: strlen($this->aesKey) where aesKey = base64_decode(EncodingAESKey.'=') — a valid 43-char key decodes to exactly 32 bytes. A larger value therefore means the aesKey string was malformed, or direct code passed bits instead of bytes; the exception is re-thrown by Encryptor as RuntimeException with code ERROR_ENCRYPT_AES.

Source

Thrown at src/Kernel/Support/Pkcs7.php:15

<?php

namespace EasyWeChat\Kernel\Support;

use EasyWeChat\Kernel\Exceptions\InvalidArgumentException;

class Pkcs7
{
    /**
     * @throws InvalidArgumentException
     */
    public static function padding(string $contents, int $blockSize): string
    {
        if ($blockSize > 32) {
            throw new InvalidArgumentException('$blockSize may not be more than 32 bytes(256 bits)');
        }
        $padding = $blockSize - (strlen($contents) % $blockSize);
        $pattern = chr($padding);

        return $contents.str_repeat($pattern, $padding);
    }

    public static function unpadding(string $contents, int $blockSize): string
    {
        $pad = ord(substr($contents, -1));
        if ($pad < 1 || $pad > $blockSize) {
            $pad = 0;
        }

        return substr($contents, 0, (strlen($contents) - $pad));
    }
}

View on GitHub (pinned to f0cf0a8b83)

Solutions

1. Use the exact 43-char EncodingAESKey from the console — Encryptor appends '=' and decodes it to 32 bytes.
2. When calling Pkcs7 directly, pass blockSize in bytes: 32 for the WeChat scheme, 16 for standard AES.
3. Validate at boot: strlen(base64_decode($aesKey.'=', true)) === 32.
4. trim() whitespace and newlines from config keys before constructing Encryptor.

Example fix

// before: blockSize passed in bits -> always > 32 -> exception
$padded = Pkcs7::padding($data, 256);
// after: bytes — 32 for the WeChat scheme, 16 for standard AES
$padded = Pkcs7::padding($data, 32);

$raw = base64_decode($aesKey.'=', true);
if ($raw === false || strlen($raw) !== 32) { throw new InvalidArgumentException('EncodingAESKey must be 43 chars decoding to 32 bytes'); }
if ($blockSize < 1 || $blockSize > 32) { throw new InvalidArgumentException('blockSize must be between 1 and 32 bytes'); }

try { $enc = $encryptor->encrypt($xml); } catch (\EasyWeChat\Kernel\Exceptions\RuntimeException $e) { // carries '$blockSize may not be more than 32 bytes' when the aesKey length is wrong \Log::error('encrypt failed: '.$e->getMessage()); throw $e; }

When it happens

Trigger: new Encryptor($appId, $token, $aesKey) with an aes_key that base64-decodes to more than 32 bytes (wrong length, extra padding characters, or the app Secret pasted instead of the EncodingAESKey), then calling encrypt()/encryptAsArray(); calling Pkcs7::padding($data, 256) or any value over 32 directly.

Common situations: Pasting the app Secret or a 44+ char string into aes_key; hand-rolled encryption copying the WeChat scheme and passing block size in bits; migrations from SDK 5.x carrying over an old key format.

Related errors

• -40006
• -40005
• token or aes_key cannot be empty.
• "%s" cannot be empty.\r\n
• -40012

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/dcc0740099861727. Report an issue: GitHub.