apache/shardingsphere · critical · FirebirdProtocolException

Unrecognised hash algorithm `%s`.

Error message

Unrecognised hash algorithm `%s`.

What it means

Thrown during Firebird SRP (Secure Remote Password) authentication: MessageDigest.getInstance(clientProofHashAlgorithm) failed with NoSuchAlgorithmException, so the configured proof hash algorithm name is not available in the JVM. Firebird SRP variants use SHA-1 (SRP) and SHA-256 (SRP256); the algorithm string must be a JCA-recognized name.

Source

Thrown at database/protocol/dialect/firebird/src/main/java/org/apache/shardingsphere/database/protocol/firebird/packet/handshake/FirebirdSRPAuthenticationData.java:207

                toBigByteArray(publicKey),
                serverSessionKey);
        sessionKey = serverSessionKey;
        return clientProof;
    }
    
    public String getPublicKeyHex() {
        return ByteArrayHelper.toHexString(pad(publicKey));
    }
    
    private byte[] clientProofHash(final byte[]... arrays) throws FirebirdProtocolException {
        try {
            MessageDigest md = MessageDigest.getInstance(clientProofHashAlgorithm);
            for (byte[] array : arrays) {
                md.update(array);
            }
            return md.digest();
        } catch (final NoSuchAlgorithmException ex) {
            throw new FirebirdProtocolException("Unrecognised hash algorithm `%s`.", clientProofHashAlgorithm);
        }
    }
    
    /**
     * Normalizes a login by uppercasing unquoted usernames, or stripping and unescaping (double) quoted user names.
     *
     * @param login login to process
     * @return normalized login
     */
    static String normalizeLogin(final String login) {
        if (login == null || login.isEmpty()) {
            return login;
        }
        if (login.length() > 2 && login.charAt(0) == '"' && login.charAt(login.length() - 1) == '"') {
            return normalizeQuotedLogin(login);
        }
        return login.toUpperCase(Locale.ROOT);
    }

View on GitHub (pinned to e952770a21)

Solutions

  1. Check the algorithm string from the exception context; verify MessageDigest.getInstance() accepts it in a plain JVM scratch test
  2. Confirm the server auth plugin is SRP or SRP256 and that the proxy translates it to 'SHA-1' or 'SHA-256' respectively
  3. Run a full JDK (not a trimmed JRE) and ensure the SUN security provider is registered in java.security
  4. If a new Firebird SRP variant is in play, add its algorithm mapping in the SRP authentication data setup and report it upstream

Example fix

// scratch check: is the algorithm available?
try {
    MessageDigest.getInstance("SHA-256"); // works on a stock JVM
} catch (NoSuchAlgorithmException e) {
    // JVM/provider problem: switch JDK or fix provider config
}
Defensive patterns

Strategy: validation

Validate before calling

// verify the algorithm exists before auth starts
private static boolean isDigestAvailable(final String algorithm) {
    try {
        MessageDigest.getInstance(algorithm);
        return true;
    } catch (NoSuchAlgorithmException ex) {
        return false;
    }
}
// if (!isDigestAvailable(clientProofHashAlgorithm)) -> fail fast with a config error instead of mid-handshake

Try / catch

try {
    authData.getPublicKeyHex(); // or the auth flow that computes the proof
} catch (FirebirdProtocolException ex) {
    // algorithm string is not JCA-resolvable: check JVM providers / plugin mapping before retrying
    throw new AuthConfigException("SRP hash algorithm unavailable on this JVM", ex);
}

Prevention

When it happens

Trigger: Authenticating with SRP/SRP256 where the negotiated plugin maps to a clientProofHashAlgorithm string the JCA does not recognize — e.g. a plugin name like 'Srp' not translated to 'SHA-1'/'SHA-256', or a JVM without the requested digest provider.

Common situations: Mis-mapped plugin-to-algorithm translation when adding a new SRP variant; stripped-down JVMs (limited JCE policy or missing providers); Firebird 3/4 servers advertising SRP variants the proxy maps incorrectly.

Related errors

AI-assisted analysis of apache/shardingsphere@e952770a21 (2026-08-14). Data as JSON: /api/errors/4f408d4526045dd5. Report an issue: GitHub.