apache/cassandra · error · RuntimeException

the requested digest algorithm

Error message

the requested digest algorithm (${algorithm}) is not available

What it means

FBUtilities.newMessageDigest obtains a JCE MessageDigest for the requested algorithm. If the JVM's security providers do not offer that algorithm, the NoSuchAlgorithmException is wrapped in a RuntimeException naming the algorithm.

Solutions

Use a standard full JDK (Oracle/OpenJDK) that includes the SUN/SecureRandom providers with SHA-1/MD5
If on a FIPS/restricted provider set, register a provider that supplies the required digest (e.g. BouncyCastle FIPS with SHA-1 allowed) or relax the policy
Verify the exact algorithm string spelling ('SHA-1', 'MD5') matches a JCE standard name

Example fix

// before
MessageDigest md = FBUtilities.newMessageDigest("SHA1-X"); // unknown
// after
MessageDigest md = FBUtilities.newMessageDigest("SHA-1");

Defensive patterns

Strategy: try-catch

Validate before calling

boolean digestAvailable(String alg) {
    try { javax.crypto.SecretKeyFactory.getInstance(alg); return false; } // placeholder
    catch (Exception e) { return false; }
}
// preferred check:
boolean hasDigest(String alg) {
    return java.security.Security.getAlgorithms("MessageDigest").contains(alg);
}

Try / catch

try {
    MessageDigest md = FBUtilities.newMessageDigest("SHA-1");
} catch (RuntimeException e) {
    // provider missing algorithm: fail fast at startup with a clear message
    throw new AssertionError("JVM lacks required digest provider: " + e.getMessage(), e);
}

Prevention

Run a full standard JDK with default security providers
On FIPS JVMs, register a provider supplying the required digests
Check Security.getAlgorithms("MessageDigest") at startup before relying on digests

When it happens

Trigger: Calling FBUtilities.newMessageDigest("SHA-1") (or another algorithm) on a JVM whose installed security providers lack the algorithm — e.g. a stripped/fips-only JCE policy or a custom JDK build.

Common situations: Running Cassandra on a FIPS-restricted JVM where SHA-1 or MD5 is disabled, minimal/custom JRE distributions missing standard providers, typos in algorithm names when code paths are parameterized.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3218d25a841cad3a. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/utils/FBUtilities.java:169

    public static int getAvailableProcessors()
    {
        return DatabaseDescriptor.getAvailableProcessors();
    }

    public static final int MAX_UNSIGNED_SHORT = 0xFFFF;

    public static final int ASM_BYTECODE_VERSION = Opcodes.ASM9;

    public static MessageDigest newMessageDigest(String algorithm)
    {
        try
        {
            return MessageDigest.getInstance(algorithm);
        }
        catch (NoSuchAlgorithmException nsae)
        {
            throw new RuntimeException("the requested digest algorithm (" + algorithm + ") is not available", nsae);
        }
    }

    /**
     * Please use getJustBroadcastAddress instead. You need this only when you have to listen/connect. It's also missing
     * the port you should be using. 99% of code doesn't want this.
     */
    public static InetAddress getJustLocalAddress()
    {
        if (localInetAddress == null)
        {
            if (DatabaseDescriptor.getListenAddress() == null)
            {
                try
                {
                    localInetAddress = InetAddress.getLocalHost();
                    logger.info("InetAddress.getLocalHost() was used to resolve listen_address to {}, double check this is "
                                + "correct. Please check your node's config and set the listen_address in cassandra.yaml accordingly if applicable.",

View on GitHub (pinned to 88fd0f6a0e)