w7corp/easywechat · error · InvalidArgumentException

Encrypt AES CBC error.

Error message

Encrypt AES CBC error.

What it means

Support\AesCbc::encrypt() runs openssl_encrypt with the fixed 'aes-128-cbc' cipher and OPENSSL_RAW_DATA; when openssl returns false it throws InvalidArgumentException carrying openssl_error_string() (e.g. 'key length not allowed') or the fallback 'Encrypt AES CBC error.'. AES-128-CBC requires a raw 16-byte key and a 16-byte IV, so any other key length fails.

Source

Thrown at src/Kernel/Support/AesCbc.php:24

use EasyWeChat\Kernel\Contracts\Aes;
use EasyWeChat\Kernel\Exceptions\InvalidArgumentException;

use function base64_decode;
use function openssl_decrypt;
use function openssl_error_string;

class AesCbc implements Aes
{
    /**
     * @throws InvalidArgumentException
     */
    public static function encrypt(string $plaintext, string $key, ?string $iv = null): string
    {
        $ciphertext = \openssl_encrypt($plaintext, 'aes-128-cbc', $key, OPENSSL_RAW_DATA, (string) $iv);

        if ($ciphertext === false) {
            throw new InvalidArgumentException(openssl_error_string() ?: 'Encrypt AES CBC error.');
        }

        return base64_encode($ciphertext);
    }

    /**
     * @throws InvalidArgumentException
     */
    public static function decrypt(string $ciphertext, string $key, ?string $iv = null): string
    {
        $plaintext = openssl_decrypt(
            base64_decode($ciphertext),
            'aes-128-cbc',
            $key,
            OPENSSL_RAW_DATA,
            (string) $iv
        );

View on GitHub (pinned to f0cf0a8b83)

Solutions

1. Provide exactly 16 raw bytes as the key (base64_decode it first if it is stored encoded) and a 16-byte IV
2. When it throws, log openssl_error_string() — it states the precise reason (usually key length)
3. If your key is 32 bytes, switch to an AES-256 cipher implementation instead of forcing AesCbc

Example fix

// before
$cipher = AesCbc::encrypt($plain, $base64Key, $base64Iv); // encoded strings -> wrong lengths

// after
$cipher = AesCbc::encrypt(
    $plain,
    base64_decode($base64Key),
    base64_decode($base64Iv)
);

// Assert key/iv lengths before encrypting (aes-128-cbc)
if (strlen($key) !== 16) {
    throw new InvalidArgumentException('AesCbc key must be 16 bytes, got '.strlen($key));
}
if (strlen((string) $iv) !== 16) {
    throw new InvalidArgumentException('AesCbc iv must be 16 bytes, got '.strlen((string) $iv));
}
$ciphertext = AesCbc::encrypt($plaintext, $key, $iv);

function isRawAes128Key(string $key): bool
{
    return strlen($key) === 16;
}

try {
    $ciphertext = AesCbc::encrypt($plaintext, $key, $iv);
} catch (\EasyWeChat\Kernel\Exceptions\InvalidArgumentException $e) {
    // openssl_error_string() in the message states the reason (usually key length)
    throw new InvalidArgumentException('AES-CBC encrypt failed: '.$e->getMessage(), 0, $e);
}

When it happens

Trigger: Encrypting with a key that is not 16 raw bytes — passing a base64- or hex-encoded key without decoding, a 32-byte key (that would be AES-256), or an empty/short IV.

Common situations: Reusing a key material meant for aes-256, forgetting base64_decode() on stored keys, deriving keys with hash('sha256') (32 bytes) instead of md5 (16 bytes).

Related errors

• Encrypt AES ECB failed.
• -40006
• Decrypt AES CBC error.
• -40012
• -40001

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/3b02be1cbb1e84fb. Report an issue: GitHub.