cyberchef 11.2.0 → 11.3.0

package/src/core/operations/GenerateHOTP.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import * as OTPAuth from "otpauth";
 
 /**
@@ -19,7 +20,7 @@ class GenerateHOTP extends Operation {
 
         this.name = "Generate HOTP";
         this.module = "Default";
-        this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated.";
+        this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7).";
         this.infoURL = "https://wikipedia.org/wiki/HMAC-based_One-time_Password_algorithm";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -27,17 +28,23 @@ class GenerateHOTP extends Operation {
             {
                 "name": "Name",
                 "type": "string",
-                "value": ""
+                "value": "Account",
+                "allowEmpty": false
             },
             {
                 "name": "Code length",
                 "type": "number",
-                "value": 6
+                "value": 6,
+                "min": 6,
+                "max": 8,
+                "integer": true
             },
             {
                 "name": "Counter",
                 "type": "number",
-                "value": 0
+                "value": 0,
+                "min": 0,
+                "integer": true
             }
         ];
     }
@@ -47,7 +54,15 @@ class GenerateHOTP extends Operation {
      */
     run(input, args) {
         const secretStr = new TextDecoder("utf-8").decode(input).trim();
-        const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : "";
+
+        let secret;
+        try {
+            secret = secretStr ?
+                OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
+                new OTPAuth.Secret();
+        } catch {
+            throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).");
+        }
 
         const hotp = new OTPAuth.HOTP({
             issuer: "",
@@ -55,7 +70,7 @@ class GenerateHOTP extends Operation {
             algorithm: "SHA1",
             digits: args[1],
             counter: args[2],
-            secret: OTPAuth.Secret.fromBase32(secret)
+            secret
         });
 
         const uri = hotp.toString();

package/src/core/operations/GenerateImage.mjs

@@ -12,6 +12,14 @@ import { toBase64 } from "../lib/Base64.mjs";
 import { isWorkerEnvironment } from "../Utils.mjs";
 import { Jimp, JimpMime, ResizeStrategy, rgbaToInt } from "jimp";
 
+// arbitrary limits to prevent resource exhaustion
+// scale factor of 64 is big enough to likely result in scaling in the display
+// window anyway
+// pixels per row is harder to come up with a figure that won't inconvenience
+// someone. 2048 feels like a reasonable compromise
+const MAX_PIXEL_SCALE_FACTOR = 64;
+const MAX_PIXELS_PER_ROW = 2048;
+
 /**
  * Generate Image operation
  */
@@ -40,11 +48,17 @@ class GenerateImage extends Operation {
                 name: "Pixel Scale Factor",
                 type: "number",
                 value: 8,
+                integer: true,
+                min: 1,
+                max: MAX_PIXEL_SCALE_FACTOR,
             },
             {
                 name: "Pixels per row",
                 type: "number",
                 value: 64,
+                integer: true,
+                min: 1,
+                max: MAX_PIXELS_PER_ROW,
             },
         ];
     }
@@ -58,14 +72,6 @@ class GenerateImage extends Operation {
         const [mode, scale, width] = args;
         input = new Uint8Array(input);
 
-        if (scale <= 0) {
-            throw new OperationError("Pixel Scale Factor needs to be > 0");
-        }
-
-        if (width <= 0) {
-            throw new OperationError("Pixels per Row needs to be > 0");
-        }
-
         const bytePerPixelMap = {
             Greyscale: 1,
             RG: 2,
@@ -74,6 +80,10 @@ class GenerateImage extends Operation {
             Bits: 1 / 8,
         };
 
+        if (!Object.hasOwn(bytePerPixelMap, mode)) {
+            throw new OperationError(`Unsupported Mode: (${mode})`);
+        }
+
         const bytesPerPixel = bytePerPixelMap[mode];
 
         if (bytesPerPixel > 0 && input.length % bytesPerPixel !== 0) {
@@ -163,8 +173,10 @@ class GenerateImage extends Operation {
         }
 
         try {
-            const imageBuffer = await image.getBuffer(JimpMime.png);
-            return imageBuffer.buffer;
+            // see https://nodejs.org/docs/latest-v24.x/api/buffer.html#bufbyteoffset
+            // for why we can't just return result.buffer
+            const result = await image.getBuffer(JimpMime.png);
+            return result.buffer.slice(result.byteOffset, result.byteOffset + result.byteLength);
         } catch (err) {
             throw new OperationError(`Error generating image. (${err})`);
         }

package/src/core/operations/GeneratePrime.mjs

@@ -0,0 +1,154 @@
+/**
+ * @author p-leriche [philip.leriche@cantab.net]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { modPow } from "../lib/BigIntUtils.mjs";
+
+/* ---------- helper functions ---------- */
+
+/**
+ * Generate random BigInt with specified bit length
+ */
+function randBigInt(bits) {
+    const bytes = Math.ceil(bits / 8);
+    const a = new Uint8Array(bytes);
+    crypto.getRandomValues(a);
+
+    // Set high bit to ensure correct bit length
+    a[0] |= 1 << (7 - ((8 * bytes - bits)));
+    // Set low bit to ensure odd (primes > 2 are odd)
+    a[bytes - 1] |= 1;
+
+    let h = "";
+    for (const b of a) h += b.toString(16).padStart(2, "0");
+    return BigInt("0x" + h);
+}
+
+/**
+ * Miller-Rabin primality test
+ */
+function isProbablePrime(n, rounds) {
+    if (n < 2n) return false;
+    if (n === 2n || n === 3n) return true;
+    if (n % 2n === 0n) return false;
+
+    // Write n-1 as 2^r * d
+    let d = n - 1n;
+    let r = 0n;
+    while (d % 2n === 0n) {
+        d /= 2n;
+        r++;
+    }
+
+    // Witness loop
+    for (let i = 0; i < rounds; i++) {
+        const a = randBigInt(n.toString(2).length - 1) % (n - 3n) + 2n;
+        let x = modPow(a, d, n);
+
+        if (x === 1n || x === n - 1n) continue;
+
+        let composite = true;
+        for (let j = 0n; j < r - 1n; j++) {
+            x = modPow(x, 2n, n);
+            if (x === n - 1n) {
+                composite = false;
+                break;
+            }
+        }
+
+        if (composite) return false;
+    }
+
+    return true;
+}
+
+/* ---------- operation class ---------- */
+
+/**
+ * Generate Prime Number operation
+ */
+class GeneratePrime extends Operation {
+    /**
+     * GeneratePrime constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Pseudo-Random Prime Generator";
+        this.module = "Crypto";
+        this.description =
+            "Generates a random probable prime number of specified bit length using the Miller-Rabin primality test.<br><br>" +
+            "<b>Primality guarantee:</b><br>" +
+            "For numbers . 3,317, the result is guaranteed prime (deterministic test).<br>" +
+            "For larger numbers, uses probabilistic testing:<br>" +
+            "- <b>Standard (7 rounds):</b> Probability of composite approx 1 in 16,000)<br><br>" +
+            "- <b>Crypto grade (40 rounds):</b> Probability of composite(approx 1 in 10^24)<br>" +
+            "Crypto grade is recommended for cryptographic applications (RSA, Diffie-Hellman, etc.).<br><br>" ;
+        this.infoURL = "https://wikipedia.org/wiki/Miller-Rabin_primality_test";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Bit length",
+                type: "number",
+                value: 512,
+                min: 2
+            },
+            {
+                name: "Crypto grade",
+                type: "boolean",
+                value: false
+            },
+            {
+                name: "Output format",
+                type: "option",
+                value: ["Decimal", "Hexadecimal"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const [bits, cryptoGrade, outputFormat] = args;
+
+        if (bits < 2) {
+            throw new OperationError("Bit length must be at least 2");
+        }
+
+        if (bits > 4096) {
+            throw new OperationError("Bit length limited to 4096 bits for performance reasons");
+        }
+
+        const rounds = cryptoGrade ? 40 : 7;
+        let attempts = 0;
+        const maxAttempts = 10000;
+
+        let n = randBigInt(bits);
+
+        while (!isProbablePrime(n, rounds)) {
+            n = randBigInt(bits);
+            attempts++;
+
+            if (attempts > maxAttempts) {
+                throw new OperationError(`Failed to generate prime after ${maxAttempts} attempts. Try a different bit length.`);
+            }
+        }
+
+        // Return only the prime for pipeability
+        if (outputFormat === "Hexadecimal") {
+            return "0x" + n.toString(16);
+        } else {
+            return n.toString();
+        }
+    }
+}
+
+export default GeneratePrime;

package/src/core/operations/GenerateTOTP.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import * as OTPAuth from "otpauth";
 
 /**
@@ -18,7 +19,7 @@ class GenerateTOTP extends Operation {
         super();
         this.name = "Generate TOTP";
         this.module = "Default";
-        this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. T0 and T1 are in seconds.";
+        this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7). T0 and T1 are in seconds.";
         this.infoURL = "https://wikipedia.org/wiki/Time-based_One-time_Password_algorithm";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -26,22 +27,30 @@ class GenerateTOTP extends Operation {
             {
                 "name": "Name",
                 "type": "string",
-                "value": ""
+                "value": "Account",
+                "allowEmpty": false
             },
             {
                 "name": "Code length",
                 "type": "number",
-                "value": 6
+                "value": 6,
+                "min": 6,
+                "max": 8,
+                "integer": true
             },
             {
                 "name": "Epoch offset (T0)",
                 "type": "number",
-                "value": 0
+                "value": 0,
+                "min": 0,
+                "integer": true
             },
             {
                 "name": "Interval (T1)",
                 "type": "number",
-                "value": 30
+                "value": 30,
+                "min": 1,
+                "integer": true
             }
         ];
     }
@@ -51,7 +60,15 @@ class GenerateTOTP extends Operation {
      */
     run(input, args) {
         const secretStr = new TextDecoder("utf-8").decode(input).trim();
-        const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : "";
+
+        let secret;
+        try {
+            secret = secretStr ?
+                OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
+                new OTPAuth.Secret();
+        } catch {
+            throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).");
+        }
 
         const totp = new OTPAuth.TOTP({
             issuer: "",
@@ -60,7 +77,7 @@ class GenerateTOTP extends Operation {
             digits: args[1],
             period: args[3],
             epoch: args[2] * 1000, // Convert seconds to milliseconds
-            secret: OTPAuth.Secret.fromBase32(secret)
+            secret
         });
 
         const uri = totp.toString();

package/src/core/operations/Gzip.mjs

@@ -74,13 +74,11 @@ class Gzip extends Operation {
         }
         if (comment.length) {
             options.flags.comment = true;
+            options.flags.fcomment = true;
             options.comment = comment;
         }
         const gzipObj = new Zlib.Gzip(new Uint8Array(input), options);
         const compressed = new Uint8Array(gzipObj.compress());
-        if (options.flags.comment && !(compressed[3] & 0x10)) {
-            compressed[3] |= 0x10;
-        }
         return compressed.buffer;
     }
 

package/src/core/operations/Jsonata.mjs

@@ -51,6 +51,18 @@ class JsonataQuery extends Operation {
 
         try {
             const expression = jsonata(query);
+            // Override built-in base64 functions which fail in Web Worker
+            // context where `window` is undefined. The jsonata library falls
+            // back to `global.Buffer` which also does not exist in workers.
+            // `atob`/`btoa` are available in both browser and worker scopes.
+            expression.registerFunction("base64decode", (str) => {
+                if (typeof str === "undefined") return undefined;
+                return atob(str);
+            }, "<s-:s>");
+            expression.registerFunction("base64encode", (str) => {
+                if (typeof str === "undefined") return undefined;
+                return btoa(str);
+            }, "<s-:s>");
             result = await expression.evaluate(jsonObj);
         } catch (err) {
             throw new OperationError(

package/src/core/operations/MIMEDecoding.mjs

@@ -87,7 +87,7 @@ class MIMEDecoding extends Operation {
             end = cur + j + "?=".length;
 
             if (encoding.toLowerCase() === "b") {
-                text = fromBase64(text);
+                text = fromBase64(text, undefined, "byteArray");
             } else if (encoding.toLowerCase() === "q") {
                 text = this.parseQEncodedWord(text);
             } else {

package/src/core/operations/MOD.mjs

@@ -0,0 +1,62 @@
+/**
+ * @license Apache-2.0
+ */
+
+import BigNumber from "bignumber.js";
+import Operation from "../Operation.mjs";
+import { createNumArray } from "../lib/Arithmetic.mjs";
+import { ARITHMETIC_DELIM_OPTIONS } from "../lib/Delim.mjs";
+
+
+/**
+ * MOD operation
+ */
+class MOD extends Operation {
+
+    /**
+     * MOD constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "MOD";
+        this.module = "Default";
+        this.description = "Computes the modulo of each number in a list with a given modulus value. Numbers are extracted from the input based on the delimiter, and non-numeric values are ignored.<br><br>e.g. <code>15 4 7</code> with modulus <code>3</code> becomes <code>0 1 1</code>";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Modulus",
+                "type": "number",
+                "value": 2
+            },
+            {
+                "name": "Delimiter",
+                "type": "option",
+                "value": ARITHMETIC_DELIM_OPTIONS,
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const modulus = new BigNumber(args[0]);
+        const delimiter = args[1];
+
+        if (modulus.isZero()) {
+            throw new Error("Modulus cannot be zero");
+        }
+
+        const numbers = createNumArray(input, delimiter);
+        const results = numbers.map(num => num.mod(modulus));
+
+        return results.join(" ");
+    }
+
+}
+
+export default MOD;

package/src/core/operations/ModularInverse.mjs

@@ -0,0 +1,107 @@
+/**
+ * @author p-leriche [philip.leriche@cantab.net]
+ * @copyright Crown Copyright 2025
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { parseBigInt, egcd } from "../lib/BigIntUtils.mjs";
+
+
+/* ---------- operation class ---------- */
+
+/**
+ * Modular Inverse operation
+ */
+class ModularInverse extends Operation {
+
+    /**
+     * ModularInverse constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "Modular Inverse";
+        this.module = "Crypto";
+        this.description =
+            "Computes the modular multiplicative inverse of <i>a</i> modulo <i>m</i>.<br><br>" +
+            "Finds <i>x</i> such that a*x = 1 (mod m).<br><br>" +
+            "<b>Input handling:</b> If either <i>a</i> or <i>m</i> is left blank, " +
+            "its value is taken from the Input field.";
+        this.infoURL = "https://wikipedia.org/wiki/Modular_multiplicative_inverse";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                name: "Value (a)",
+                type: "string",
+                value: ""
+            },
+            {
+                name: "Modulus (m)",
+                type: "string",
+                value: ""
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const [aStr, mStr] = args;
+
+        // Trim everything so "" and "   " count as empty
+        const aParam = aStr?.trim();
+        const mParam = mStr?.trim();
+        const inputVal = input?.trim();
+
+        let a, m;
+
+        if (aParam && mParam) {
+            // Case 1: value and modulus both given as parameters
+            a = aParam;
+            m = mParam;
+        } else if (!aParam && mParam) {
+            // Case 2: value missing - take from input
+            a = inputVal;
+            m = mParam;
+            if (!a) throw new OperationError("Value (a) must be defined");
+        } else if (aParam && !mParam) {
+            // Case 3: modulus missing - take from input
+            a = aParam;
+            m = inputVal;
+            if (!m) throw new OperationError("Modulus (m) must be defined");
+        } else if (!aParam && !mParam) {
+            // Case 4: value and modulus both missing
+            throw new OperationError("Value (a) and Modulus (m) must be defined");
+        }
+
+        const aBI = parseBigInt(a, "Value (a)");
+        const mBI = parseBigInt(m, "Modulus (m)");
+
+        if (mBI <= 0n) {
+            throw new OperationError("Modulus must be greater than zero");
+        }
+
+        const aNorm = ((aBI % mBI) + mBI) % mBI;
+        const [g, x] = egcd(aNorm, mBI);
+
+        if (g !== 1n && g !== -1n) {
+            throw new OperationError("Inverse does not exist because gcd(a, m) ≠ 1");
+        }
+
+        let inv = x;
+        if (g === -1n) inv = -inv;
+
+        inv = ((inv % mBI) + mBI) % mBI;
+
+
+        return inv.toString();
+    }
+}
+
+export default ModularInverse;

package/src/core/operations/PRESENTDecrypt.mjs

@@ -0,0 +1,94 @@
+/**
+ * @author Medjedtxm
+ * @copyright Crown Copyright 2026
+ * @license Apache-2.0
+ */
+
+import Operation from "../Operation.mjs";
+import Utils from "../Utils.mjs";
+import OperationError from "../errors/OperationError.mjs";
+import { toHex } from "../lib/Hex.mjs";
+import { decryptPRESENT } from "../lib/Present.mjs";
+
+/**
+ * PRESENT Decrypt operation
+ */
+class PRESENTDecrypt extends Operation {
+
+    /**
+     * PRESENTDecrypt constructor
+     */
+    constructor() {
+        super();
+
+        this.name = "PRESENT Decrypt";
+        this.module = "Ciphers";
+        this.description = "PRESENT is an ultra-lightweight block cipher designed for constrained environments such as RFID tags and sensor networks. It operates on 64-bit blocks and supports 80-bit or 128-bit keys with 31 rounds. Standardised in ISO/IEC 29192-2:2019.<br><br>When using CBC mode, the PKCS#7 padding scheme is used.";
+        this.infoURL = "https://wikipedia.org/wiki/PRESENT_(cipher)";
+        this.inputType = "string";
+        this.outputType = "string";
+        this.args = [
+            {
+                "name": "Key",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "IV",
+                "type": "toggleString",
+                "value": "",
+                "toggleValues": ["Hex", "UTF8", "Latin1", "Base64"]
+            },
+            {
+                "name": "Mode",
+                "type": "option",
+                "value": ["CBC", "ECB"]
+            },
+            {
+                "name": "Input",
+                "type": "option",
+                "value": ["Hex", "Raw"]
+            },
+            {
+                "name": "Output",
+                "type": "option",
+                "value": ["Raw", "Hex"]
+            },
+            {
+                "name": "Padding",
+                "type": "option",
+                "value": ["PKCS5", "NO", "ZERO", "RANDOM", "BIT"]
+            }
+        ];
+    }
+
+    /**
+     * @param {string} input
+     * @param {Object[]} args
+     * @returns {string}
+     */
+    run(input, args) {
+        const key = Utils.convertToByteArray(args[0].string, args[0].option),
+            iv = Utils.convertToByteArray(args[1].string, args[1].option),
+            [,, mode, inputType, outputType, padding] = args;
+
+        if (key.length !== 10 && key.length !== 16)
+            throw new OperationError(`Invalid key length: ${key.length} bytes
+
+PRESENT uses a key length of 10 bytes (80 bits) or 16 bytes (128 bits).`);
+
+        if (iv.length !== 8 && mode !== "ECB")
+            throw new OperationError(`Invalid IV length: ${iv.length} bytes
+
+PRESENT uses an IV length of 8 bytes (64 bits).
+Make sure you have specified the type correctly (e.g. Hex vs UTF8).`);
+
+        input = Utils.convertToByteArray(input, inputType);
+        const output = decryptPRESENT(input, key, iv, mode, padding);
+        return outputType === "Hex" ? toHex(output, "") : Utils.byteArrayToUtf8(output);
+    }
+
+}
+
+export default PRESENTDecrypt;