#3 | Add AES key length validation

Author: alan-null

Crypto.AES/Public/Protect-Data.ps1

@@ -31,6 +31,9 @@ function Protect-Data {
         $tag = [byte[]]::new(16)
 
         if ($PSCmdlet.ParameterSetName -eq 'Key') {
+            if ($Key.Length -notin @(16, 24, 32)) {
+                throw "Invalid AES key length. Must be 16, 24, or 32 bytes."
+            }
             $GCM = [System.Security.Cryptography.AesGcm]::new($Key)
             try {
                 $GCM.Encrypt($Nonce, $Data, $cipherOutput, $tag)

Tests/Crypto.AES.Tests.ps1

@@ -17,6 +17,12 @@ Describe 'Crypto.AES.Tests' {
         }
     }
 
+    Context "Protect-Data - parameter validation" {
+        It "Throws error for invalid key length" {
+            { Protect-Data -Key ([byte[]]::new(10)) -Data ([byte[]]::new(16)) } | Should -Throw "Invalid AES key length. Must be 16, 24, or 32 bytes."
+        }
+    }
+
     Context "Protect-Data - Result" {
         $Key = [byte[]]::new(32)
         $nonce = [byte[]]::new(12)