{"record":{"id":"2fdc4a8e279493df","repo":"spring-projects/spring-security","slug":"memory-cost-must-be-1","errorCode":null,"errorMessage":"Memory cost must be >= 1.","messagePattern":"Memory cost must be >= 1\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java","lineNumber":105,"sourceCode":"\t * @param memoryCost memory cost of the algorithm (as defined in scrypt this is r)\n\t * Default is currently 8.\n\t * @param parallelization the parallelization of the algorithm (as defined in scrypt\n\t * this is p) Default is currently 1. Note that the implementation does not currently\n\t * take advantage of parallelization.\n\t * @param keyLength key length for the algorithm (as defined in scrypt this is dkLen).\n\t * The default is currently 32.\n\t * @param saltLength salt length (as defined in scrypt this is the length of S). The\n\t * default is currently 16.\n\t */\n\tpublic SCryptPasswordEncoder(int cpuCost, int memoryCost, int parallelization, int keyLength, int saltLength) {\n\t\tif (cpuCost <= 1) {\n\t\t\tthrow new IllegalArgumentException(\"Cpu cost parameter must be > 1.\");\n\t\t}\n\t\tif (memoryCost == 1 && cpuCost > 65536) {\n\t\t\tthrow new IllegalArgumentException(\"Cpu cost parameter must be > 1 and < 65536.\");\n\t\t}\n\t\tif (memoryCost < 1) {\n\t\t\tthrow new IllegalArgumentException(\"Memory cost must be >= 1.\");\n\t\t}\n\t\tint maxParallel = Integer.MAX_VALUE / (128 * memoryCost * 8);\n\t\tif (parallelization < 1 || parallelization > maxParallel) {\n\t\t\tthrow new IllegalArgumentException(\"Parallelisation parameter p must be >= 1 and <= \" + maxParallel\n\t\t\t\t\t+ \" (based on block size r of \" + memoryCost + \")\");\n\t\t}\n\t\tif (keyLength < 1 || keyLength > Integer.MAX_VALUE) {\n\t\t\tthrow new IllegalArgumentException(\"Key length must be >= 1 and <= \" + Integer.MAX_VALUE);\n\t\t}\n\t\tif (saltLength < 1 || saltLength > Integer.MAX_VALUE) {\n\t\t\tthrow new IllegalArgumentException(\"Salt length must be >= 1 and <= \" + Integer.MAX_VALUE);\n\t\t}\n\t\tthis.cpuCost = cpuCost;\n\t\tthis.memoryCost = memoryCost;\n\t\tthis.parallelization = parallelization;\n\t\tthis.keyLength = keyLength;\n\t\tthis.saltGenerator = KeyGenerators.secureRandom(saltLength);\n\t}","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java#L87-L123","documentation":"The memoryCost (r) parameter of scrypt is the block size and must be at least 1. SCryptPasswordEncoder validates this in its 5-arg constructor and throws IllegalArgumentException when r < 1, because scrypt cannot operate with a zero or negative block size.","triggerScenarios":"`new SCryptPasswordEncoder(cpuCost, memoryCost, ...)` with memoryCost < 1 (0 or negative).","commonSituations":"Reading parameters from config/properties files where r defaults to 0 when unset; integer parse failures coerced to 0; typos swapping r and p arguments.","solutions":["Pass memoryCost >= 1 (the library default is 8).","Validate/parse the config value before constructing the encoder.","Use the no-arg SCryptPasswordEncoder() to accept secure defaults."],"exampleFix":"// before\nnew SCryptPasswordEncoder(16384, 0, 1, 32, 64);\n// after\nnew SCryptPasswordEncoder(16384, 8, 1, 32, 64);","handlingStrategy":"validation","validationCode":"if (memoryCost < 1) {\n    throw new IllegalArgumentException(\"memoryCost (r) must be >= 1: \" + memoryCost);\n}\nnew SCryptPasswordEncoder(cpuCost, memoryCost, p, keyLen, saltLen);","typeGuard":null,"tryCatchPattern":"try {\n    encoder = new SCryptPasswordEncoder(cpuCost, r, p, keyLen, saltLen);\n} catch (IllegalArgumentException e) {\n    encoder = new SCryptPasswordEncoder();\n}","preventionTips":["Default r to 8 when config value is absent/0.","Don't swap r and p argument positions.","Assert config values after parsing."],"tags":["java","spring-security","password-hashing","validation","constructor"],"backgroundTag":"invalid-constructor-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}