SEED Decrypt

Category: Symmetric Ciphers · Node Type ID: symmetric-seed-decrypt

KISA National Standard SEED 128/256-bit Block Cipher Decryption

Overview

Decrypts ciphertext produced by SEED Encrypt using the KISA SEED-128 (16B key) or SEED-256 (32B key) block cipher (RFC 4269). In GCM and CCM modes, verifies the 16-byte Auth Tag before outputting plaintext.

When to Use

Decrypting and verifying SEED-128 or SEED-256 ciphertexts in KISA / Korean financial protocols.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Cipher Mode `mode`	`select` Default: `ECB`	Always visible	Must match the Cipher Mode used during encryption. See Block Cipher Modes for full details. `ECB`: ECB (Electronic Codebook) `CBC`: CBC (Cipher Block Chaining) `GCM`: GCM (AEAD) `CCM`: CCM (AEAD) `CTR`: CTR (Counter Mode)
Padding `padding`	`select` Default: `None`	Always visible	16-byte block unpadding scheme applied in `ECB` and `CBC` modes. See Padding Schemes for full details. `None`: None `ISO7816`: ISO/IEC 9797-1 Method 2 (ISO/IEC 7816-4) `ISO97971M3`: ISO/IEC 9797-1 Method 3 `PKCS7`: PKCS#7 (RFC 5652) `ANSIX923`: ANSI X9.23
Unify Errors `errorUnify`	`boolean` Default: `false` Supports Variable Reference (`$var`: `bool`)	Always visible	Replaces built-in errors with a custom error code/message when enabled.
Unified Error Code `errorUnifyCode`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorUnify` is `true`	Custom error code when Unify Errors is enabled.
Unified Error Message `errorUnifyMessage`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorUnify` is `true`	Custom error message when Unify Errors is enabled.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (6 total; conditionally visible ports depend on parameter settings as shown below).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Key`	`key`	`Bytes` (16/32B)	Required	Always visible	SEED secret key: `16` bytes (SEED-128) or `32` bytes (SEED-256).
`Ciphertext`	`ciphertext`	`Bytes`	Required	Always visible	Encrypted byte array (`Uint8Array`) to decrypt.
`IV`	`iv`	`Bytes` (16B)	Optional	When `mode` is `CBC` or `CTR`	16-byte IV used during encryption in `CBC`, `CTR`, `CFB`, and `OFB` modes.
`Nonce`	`nonce`	`Bytes` (12B)	Optional	When `mode` is `GCM` or `CCM`	12-byte AEAD nonce used during encryption in `GCM` and `CCM` modes.
`Auth Tag`	`tag`	`Bytes` (GCM/CCM)	Optional	When `mode` is `GCM` or `CCM`	Required 16-byte authentication tag to verify in `GCM` and `CCM` modes.
`AAD`	`aad`	`Bytes` (GCM/CCM)	Optional	When `mode` is `GCM` or `CCM`	Optional Additional Authenticated Data in `GCM` and `CCM` modes.

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Plaintext`	`plaintext`	`Bytes`	Always visible	Decrypted plaintext byte array (`Uint8Array`).

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute. Enabling Unify Errors (errorUnify) replaces all error codes below with your configured unified error code and message.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_LENGTH`	Invalid key length	Raised when `Key` is neither 16 nor 32 bytes.
`INVALID_IV_LENGTH`	Invalid IV length	Raised when a connected `IV` is not 16 bytes or `Nonce` is not 12 bytes.
`CIPHERTEXT_NOT_BLOCK_ALIGNED`	Ciphertext length is not a multiple of the block size	Raised in `ECB`/`CBC` mode when `Ciphertext` length is not a positive multiple of 16 bytes.
`INVALID_PADDING`	Invalid padding	Raised when the decrypted or input block's trailing bytes violate the structure of the selected padding standard.
`INVALID_NONCE_LENGTH`	Invalid nonce length	Raised when a connected AEAD or stream-cipher `Nonce` is not 12 bytes (96 bits).
`INVALID_TAG_LENGTH`	Invalid authentication tag length	Raised when the connected AEAD `Auth Tag` is not 16 bytes (128 bits).
`AUTH_TAG_MISMATCH`	Authentication tag mismatch	Raised in `GCM`/`CCM` mode when the authentication tag fails verification.

Examples

Decrypting a SEED-128-CBC Ciphertext

Recover the original plaintext using the same 16-byte SEED key and IV.

Connect the 16-byte Key, 16-byte IV, and Ciphertext to SEED Decrypt with Mode = CBC and Padding = PKCS#7.