Cryptographic failures are usually parameter failures. Record the algorithm, mode, key bytes, IV or nonce, input representation, padding, output representation, and—when applicable—authentication tag and additional authenticated data.
AES example design
For AES Decrypt, keys must be 16, 24, or 32 bytes for AES-128, AES-192, or AES-256. The IV is normally 16 bytes. CBC and ECB use PKCS#7 padding by default; GCM additionally needs a tag and may use authenticated data.
Build order
- Decode the ciphertext wrapper, such as Base64 or hexadecimal.
- Configure the key’s representation explicitly.
- Configure the IV, or select whether it is read from the start or end of input.
- Select the exact mode and padding behavior.
- Preserve raw output until decryption succeeds.
- Decode text only after the plaintext byte encoding is known.
Debugging signals
- Invalid key length means the representation or supplied key is wrong.
- Plausible length but random output points to the wrong key, IV, mode, or counter layout.
- A padding failure often indicates wrong parameters, not merely wrong padding.
- A GCM authentication failure must not be ignored; do not present unauthenticated plaintext as valid.