Skip to main content
Tool Factory

Cryptography & Ciphers

GOST Decryption

Decrypt GOST 28147, Magma, or Kuznyechik with exact 32-byte keys, strict input formats, and checked padding. Run the Magma sample.

Tool workspace

Your input stays in this browser.

The tool is ready to run.

Ready

Run the tool when your input is ready.

Paste Hex, Base64, or Raw ciphertext. Select its encoding below.

Options

Use exactly 32 key bytes. Hex needs 64 digits. No password derivation occurs.

Supply the IV explicitly. Magma uses 8-byte blocks; Kuznyechik uses 16-byte blocks. GOST 2015 CTR needs half a block.

Hex preserves binary plaintext. Raw requires valid UTF-8 and retains a leading byte-order mark.

CP key meshing applies only to GOST 28147 (1989) CFB. Other combinations require NO.

CBC and ECB check padding. PKCS5 uses repeated length bytes. BIT uses 01 then zeros. NO, ZERO, and RANDOM retain bytes.

Ready for a result

Decrypt GOST 28147, Magma, or Kuznyechik with exact 32-byte keys, strict input formats, and checked padding. Run the Magma sample.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

GOST 28147 uses a selectable substitution box. Magma and Kuznyechik use fixed transformations.

Hex output preserves plaintext bytes. Raw output requires valid UTF-8.

  • Reproduce the published Magma and Kuznyechik vectors before checking captured ciphertext.

Sources: RFC 8891: Magma key and decryption example; RFC 7801: Kuznyechik key and decryption example; RFC 4357: GOST 28147 parameters and CryptoPro key meshing; RFC 5652 section 6.3: repeated-length padding

Key sizes, block sizes, and authentication

  • GOST 28147 and GOST 2015 use different CTR constructions.
  • CP key meshing applies only to GOST 28147 CFB on this page.
  • BIT uses the legacy 01 marker followed by zeros.
  • Successful decryption does not authenticate the ciphertext.

Match the GOST algorithm and mode

  1. Select Algorithm and enter the key with its encoding.
  2. Match Block mode, IV, Padding, and key meshing to the sender.
  3. Use the sender’s sBox for GOST 28147.

Check a Magma ciphertext block

Input: 4ee901e5c2d8ca3d

Settings: Key Hex: ffeeddccbbaa99887766554433221100f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff; Magma; ECB; Input Hex; Output Hex; Padding NO; Key meshing NO; IV blank.

Result: fedcba9876543210

RFC 8891 supplies this key, ciphertext, and plaintext. The sBox selector has no effect on Magma.

Questions

Does a padding error identify the wrong setting?

No. The key, mode, IV, ciphertext, or padding convention can cause it.