alibaba/spring-ai-alibaba · error · IllegalArgumentException

Amount of performance parameters invalid

Error message

Amount of performance parameters invalid

What it means

After splitting an Argon2 hash, match parses the performance parameter section (m=...,t=...,p=...). If the section does not contain exactly 3 comma-separated parameters, the encoded hash is malformed and IllegalArgumentException("Amount of performance parameters invalid") is thrown.

Source

Thrown at spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/security/PasswordCryptUtils.java:106

	 * @return true if the password matches, false otherwise
	 * @throws IllegalArgumentException if the encoded password format is invalid
	 */
	public static boolean match(String password, String encodedPassword) {
		String[] parts = encodedPassword.split("\\$");
		if (parts.length < 4) {
			throw new IllegalArgumentException("Invalid encoded Argon2-hash");
		}

		Argon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);

		if (parts[2].startsWith("$v=")) {
			int version = Integer.parseInt(parts[0].substring(2));
			builder.withVersion(version);
		}

		String[] perfParams = parts[3].split(",");
		if (perfParams.length != 3) {
			throw new IllegalArgumentException("Amount of performance parameters invalid");
		}

		if (!perfParams[0].startsWith("m=")) {
			throw new IllegalArgumentException("Invalid memory parameter");
		}
		builder.withMemoryAsKB(Integer.parseInt(perfParams[0].substring(2)));
		if (!perfParams[1].startsWith("t=")) {
			throw new IllegalArgumentException("Invalid iterations parameter");
		}
		builder.withIterations(Integer.parseInt(perfParams[1].substring(2)));
		if (!perfParams[2].startsWith("p=")) {
			throw new IllegalArgumentException("Invalid parallel parameter");
		}
		builder.withParallelism(Integer.parseInt(perfParams[2].substring(2)));

		builder.withSalt(b64decoder.decode(parts[4]));

		byte[] decoded = b64decoder.decode(parts[5]);

View on GitHub (pinned to f82da0b50f)

Solutions

1. Inspect the stored hash's parameter segment; it must look like m=65536,t=2,p=1
2. Re-hash affected passwords with PasswordCryptUtils and update the rows
3. Pre-validate the perf segment (split(',')==3 and each startsWith m=/t=/p=) before calling match
4. Ensure DB columns are wide enough and no trimming/normalization mangles stored hashes

Example fix

// before
boolean ok = PasswordCryptUtils.match(raw, stored); // throws if perf params malformed
// after
String[] parts = stored.split("\\$");
boolean ok = parts.length > 3 && parts[3].split(",").length == 3
        && PasswordCryptUtils.match(raw, stored);

boolean hasValidPerfParams(String stored) {
    String[] parts = stored == null ? new String[0] : stored.split("\\$");
    if (parts.length < 4) return false;
    String[] perf = parts[3].split(",");
    return perf.length == 3 && perf[0].startsWith("m=") && perf[1].startsWith("t=") && perf[2].startsWith("p=");
}

try {
    boolean ok = PasswordCryptUtils.match(raw, stored);
} catch (IllegalArgumentException e) {
    ok = false; // corrupt hash: deny login, schedule re-hash
}

When it happens

Trigger: Calling PasswordCryptUtils.match with an encoded hash whose 4th '$'-part splits into something other than 3 comma-separated items — e.g. missing t= or p=, extra commas, or a corrupted/truncated m=t=,p= segment.

Common situations: Hashes produced by non-JVM Argon2 implementations with different parameter serialization; manual editing of stored hashes; truncation by fixed-width DB columns cutting the tail parameters.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid encoded Argon2-hash
• Invalid memory parameter
• Invalid iterations parameter
• Invalid parallel parameter
• 非法路径访问尝试: ${path}

AI-assisted analysis of alibaba/spring-ai-alibaba@f82da0b50f (2026-09-09). Data as JSON: /api/errors/293a19b97917aed6. Report an issue: GitHub.