{"record":{"id":"38f85cf633771881","repo":"yiisoft/yii2","slug":"invalid-parameters-to-hash-pbkdf2","errorCode":null,"errorMessage":"Invalid parameters to hash_pbkdf2()","messagePattern":"Invalid parameters to hash_pbkdf2\\(\\)","errorType":"exception","errorClass":"InvalidArgumentException","httpStatus":null,"severity":"error","filePath":"framework/base/Security.php","lineNumber":327,"sourceCode":"    /**\n     * Derives a key from the given password using the standard PBKDF2 algorithm.\n     * Implements HKDF2 specified in [RFC 2898](https://datatracker.ietf.org/doc/html/rfc2898#section-5.2)\n     * Recommend use one of the SHA-2 hash algorithms: sha224, sha256, sha384 or sha512.\n     * @param string $algo a hash algorithm supported by `hash_hmac()`, e.g. 'SHA-256'\n     * @param string $password the source password\n     * @param string $salt the random salt\n     * @param int $iterations the number of iterations of the hash algorithm. Set as high as\n     * possible to hinder dictionary password attacks.\n     * @param int $length length of the output key in bytes. If 0, the output key is\n     * the length of the hash algorithm output.\n     * @return string the derived key\n     * @throws InvalidArgumentException when hash generation fails due to invalid params given.\n     */\n    public function pbkdf2($algo, $password, $salt, $iterations, $length = 0)\n    {\n        $outputKey = hash_pbkdf2($algo, $password, $salt, $iterations, $length, true);\n        if ($outputKey === false) {\n            throw new InvalidArgumentException('Invalid parameters to hash_pbkdf2()');\n        }\n\n        return $outputKey;\n    }\n\n    /**\n     * Prefixes data with a keyed hash value so that it can later be detected if it is tampered.\n     * There is no need to hash inputs or outputs of [[encryptByKey()]] or [[encryptByPassword()]]\n     * as those methods perform the task.\n     * @param string $data the data to be protected\n     * @param string $key the secret key to be used for generating hash. Should be a secure\n     * cryptographic key.\n     * @param bool $rawHash whether the generated hash value is in raw binary format. If false, lowercase\n     * hex digits will be generated.\n     * @return string the data prefixed with the keyed hash\n     * @throws InvalidConfigException when HMAC generation fails.\n     * @see validateData()\n     * @see generateRandomKey()","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/yiisoft/yii2/blob/66f00d18a29b520f85e8e8f1e32d1e7e7b556cac/framework/base/Security.php#L309-L345","documentation":"Security::pbkdf2() wraps hash_pbkdf2() and maps a false return to InvalidArgumentException. false indicates a bad parameter combination: an algorithm unknown to the hash extension, a non-positive iteration count, or a negative output length. For the Security component this usually means kdfHash or derivationIterations (used for password-based encryption) were misconfigured.","triggerScenarios":"'derivationIterations' => 0 from casting a missing environment variable; kdfHash typo; calling pbkdf2() directly with $iterations = 0 or a negative $length; note that on newer PHP versions some invalid inputs raise ValueError directly from hash_pbkdf2() instead of surfacing this wrapper message.","commonSituations":"Environment-driven security settings where a missing var coerces to 0; hardening iterations to values copied between PHP versions; config drift between environments sharing derived-key data.","solutions":["Set derivationIterations to a positive integer (framework default 100000)","Correct kdfHash to a hash_algos() entry such as 'sha256'","Normalize env-derived values before assigning: max(1, (int) ($envValue ?: 100000))","Add a bootstrap check that kdfHash is a known algorithm and iterations >= 1"],"exampleFix":"// before\n'components' => [\n    'security' => [\n        'derivationIterations' => (int) getenv('KDF_ITERATIONS'), // missing env → 0\n    ],\n],\n\n// after\n'components' => [\n    'security' => [\n        'derivationIterations' => max(1, (int) (getenv('KDF_ITERATIONS') ?: 100000)),\n    ],\n],","handlingStrategy":"validation","validationCode":"if (!in_array($algo, hash_algos(), true) || $iterations < 1 || $length < 0) {\n    throw new \\RuntimeException('Invalid PBKDF2 parameters');\n}\n$dk = Yii::$app->security->pbkdf2($algo, $password, $salt, $iterations, $length);","typeGuard":null,"tryCatchPattern":"try {\n    $dk = Yii::$app->security->pbkdf2('sha256', $password, $salt, 100000, 32);\n} catch (\\InvalidArgumentException $e) {\n    // bad algo/iterations/length — correct inputs instead of retrying\n}","preventionTips":["Normalize env-derived derivationIterations with max(1, (int) $value) before assignment","Fix kdfHash to a hash_algos() entry such as 'sha256'","Assert iterations >= 1 and known algorithms at bootstrap"],"tags":["php","yii2","security","pbkdf2","key-derivation","hash"],"backgroundTag":"invalid-kdf-parameters","analyzedSha":"66f00d18a29b520f85e8e8f1e32d1e7e7b556cac","analyzedAt":"2026-08-17T05:17:23.470Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}