alibaba/spring-ai-alibaba · error · IllegalArgumentException

Invalid iterations parameter

Error message

Invalid iterations parameter

What it means

In PasswordCryptUtils.match(), the second performance parameter of the stored Argon2 hash (parts[3]) must start with 't=' to supply the iteration count. When perfParams[1] lacks the 't=' prefix, match() throws this IllegalArgumentException.

Source

Thrown at spring-ai-alibaba-admin/spring-ai-alibaba-admin-server-core/src/main/java/com/alibaba/cloud/ai/studio/core/utils/security/PasswordCryptUtils.java:114

		Argon2Parameters.Builder builder = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id);

		if (parts[2].startsWith("$v=")) {
			int version = Integer.parseInt(parts[0].substring(2));
			builder.withVersion(version);
		}

		String[] perfParams = parts[3].split(",");
		if (perfParams.length != 3) {
			throw new IllegalArgumentException("Amount of performance parameters invalid");
		}

		if (!perfParams[0].startsWith("m=")) {
			throw new IllegalArgumentException("Invalid memory parameter");
		}
		builder.withMemoryAsKB(Integer.parseInt(perfParams[0].substring(2)));
		if (!perfParams[1].startsWith("t=")) {
			throw new IllegalArgumentException("Invalid iterations parameter");
		}
		builder.withIterations(Integer.parseInt(perfParams[1].substring(2)));
		if (!perfParams[2].startsWith("p=")) {
			throw new IllegalArgumentException("Invalid parallel parameter");
		}
		builder.withParallelism(Integer.parseInt(perfParams[2].substring(2)));

		builder.withSalt(b64decoder.decode(parts[4]));

		byte[] decoded = b64decoder.decode(parts[5]);
		byte[] hashBytes = new byte[decoded.length];

		Argon2BytesGenerator generator = new Argon2BytesGenerator();
		generator.init(builder.build());
		generator.generateBytes(password.toCharArray(), hashBytes);

		int result = 0;
		for (int i = 0; i < decoded.length; i++) {

View on GitHub (pinned to f82da0b50f)

Solutions

1. Inspect parts[3] of the stored hash and correct the second parameter to the form 't=<iterations>'
2. Regenerate the hash with PasswordCryptUtils.encode() so it matches the expected PHC layout
3. If hashes are from a legacy system, write a one-time migration to normalize the parameter segment

Example fix

// before
m=65536,iter=2,p=1
// after
m=65536,t=2,p=1

String perfSeg = storedHash.split("\\$")[3];
boolean hasT = perfSeg.split(",")[1].startsWith("t=");
if (!hasT) throw new IllegalStateException("Hash missing t= iterations param: " + perfSeg);

static boolean hasIterationsParam(String hash) {
    String[] parts = hash.split("\\$");
    return parts.length >= 4 && parts[3].split(",").length >= 2 && parts[3].split(",")[1].startsWith("t=");
}

try {
    cryptUtils.match(rawPassword, storedHash);
} catch (IllegalArgumentException e) {
    log.warn("Hash iterations param invalid: {}", e.getMessage());
    return false; // treat as failed auth, force re-hash on next login
}

When it happens

Trigger: Calling match(rawPassword, storedHash) where the hash's parameter segment has a second item not prefixed with 't=' (e.g. 'm=65536,it=2,p=1' or items in the wrong order).

Common situations: Hashes generated by tools with different parameter naming, manual edits to stored hashes, or truncated/corrupted hash rows after a DB migration.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid memory parameter
• Invalid parallel parameter
• Invalid encoded Argon2-hash
• Amount of performance parameters invalid
• parse default-default-application.yml failed

AI-assisted analysis of alibaba/spring-ai-alibaba@f82da0b50f (2026-09-09). Data as JSON: /api/errors/b339f7a1ea1348b4. Report an issue: GitHub.