apache/cassandra · error · InvalidRequestException

Hash algorithm not found: ${algorithm}

Error message

Hash algorithm not found: ${algorithm}

What it means

HashMaskingFunction.messageDigest resolves a JCA MessageDigest for the algorithm name given to mask_hash. If the JVM has no registered provider for that algorithm, the NoSuchAlgorithmException is translated into this InvalidRequestException naming the unsupported algorithm.

Source

Thrown at src/java/org/apache/cassandra/cql3/functions/masking/HashMaskingFunction.java:128

        MessageDigest digest = DIGESTS.get(cacheKey);
        if (digest == null)
        {
            digest = messageDigest(UTF8Type.instance.compose(cacheKey));
            DIGESTS.put(cacheKey.duplicate(), digest);
        }
        return digest;
    }

    @VisibleForTesting
    static MessageDigest messageDigest(String algorithm)
    {
        try
        {
            return MessageDigest.getInstance(algorithm);
        }
        catch (NoSuchAlgorithmException e)
        {
            throw new InvalidRequestException("Hash algorithm not found: " + algorithm);
        }
    }

    /** @return a {@link FunctionFactory} to build new {@link HashMaskingFunction}s. */
    public static FunctionFactory factory()
    {
        return new MaskingFunction.Factory(NAME,
                                           FunctionParameter.anyType(false),
                                           FunctionParameter.optional(FunctionParameter.fixed(CQL3Type.Native.TEXT)))
        {
            @Override
            protected NativeFunction doGetOrCreateFunction(List<AbstractType<?>> argTypes, AbstractType<?> receiverType)
            {
                switch (argTypes.size())
                {
                    case 1:
                        return new HashMaskingFunction(name, argTypes.get(0), false);
                    case 2:

View on GitHub (pinned to 88fd0f6a0e)

Solutions

  1. Use a standard algorithm supported by the JVM, e.g. 'MD5', 'SHA-1', 'SHA-256', 'SHA-512'
  2. Check available algorithms with java.security.Security.getAlgorithms("MessageDigest") and pick one from the list
  3. If a non-default algorithm is required, run on a JDK that provides it or add the security provider

Example fix

// before
CREATE TABLE users (email text MASKED WITH mask_hash(email, 'SHA3'));
// after
CREATE TABLE users (email text MASKED WITH mask_hash(email, 'SHA-256'));
Defensive patterns

Strategy: validation

Validate before calling

Set<String> available = java.security.Security.getAlgorithms("MessageDigest");
if (!available.contains("SHA-256")) throw new IllegalArgumentException("hash algorithm not available in this JVM");

Try / catch

try {
    session.execute("CREATE TABLE ... MASKED WITH mask_hash(col, 'SHA-256')");
} catch (InvalidRequestException e) {
    if (e.getMessage().startsWith("Hash algorithm not found")) {
        // retry with a JVM-supported algorithm
    }
}

Prevention

When it happens

Trigger: Using mask_hash('mycolumn', 'SHA3') or any algorithm name that is not available in the JVM's MessageDigest provider set (e.g. a typo like 'sha1 ' or 'MD6', or a non-standard algorithm on a stripped-down JRE).

Common situations: Typos in the algorithm argument; using algorithm names valid on newer JDKs while running Cassandra on an older Java 11 JRE; running on a custom JRE with fewer security providers.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/6c7e1d25af85094c. Report an issue: GitHub.