{"record":{"id":"409d765296523e5b","repo":"prestodb/presto","slug":"pbkdf2-password-input-is-malformed","errorCode":null,"errorMessage":"PBKDF2 password input is malformed","messagePattern":"PBKDF2 password input is malformed","errorType":"validation","errorClass":"HashedPasswordException","httpStatus":null,"severity":"error","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java","lineNumber":88,"sourceCode":"        // Validate using PBKDF2WithHmacSHA256\n        if (validatePBKDF2Password(inputPassword, password, \"PBKDF2WithHmacSHA256\")) {\n            return true;\n        }\n\n        // Fallback to PBKDF2WithHmacSHA1\n        LOG.warn(\"Using deprecated PBKDF2WithHmacSHA1 for password validation.\");\n        return validatePBKDF2Password(inputPassword, password, \"PBKDF2WithHmacSHA1\");\n    }\n\n    private static boolean validatePBKDF2Password(String inputPassword, PBKDF2Password password, String algorithm)\n    {\n        try {\n            KeySpec spec = new PBEKeySpec(inputPassword.toCharArray(), password.salt(), password.iterations(), password.hash().length * 8);\n            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm);\n            byte[] inputHash = keyFactory.generateSecret(spec).getEncoded();\n\n            if (password.hash().length != inputHash.length) {\n                throw new HashedPasswordException(\"PBKDF2 password input is malformed\");\n            }\n            return MessageDigest.isEqual(password.hash(), inputHash);\n        }\n        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {\n            throw new HashedPasswordException(\"Invalid PBKDF2 password\", e);\n        }\n    }\n\n    public static HashingAlgorithm getHashingAlgorithm(String password)\n    {\n        if (password.startsWith(\"$2y\")) {\n            if (getBCryptCost(password) < BCRYPT_MIN_COST) {\n                throw new HashedPasswordException(\"Minimum cost of BCrypt password must be \" + BCRYPT_MIN_COST);\n            }\n            return HashingAlgorithm.BCRYPT;\n        }\n\n        if (password.contains(\":\")) {","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java#L70-L106","documentation":"Guard in validatePBKDF2Password: the stored PBKDF2 record's derived hash length does not match the recomputed input hash length, so the stored entry is structurally malformed (wrong fields or wrong algorithm parameters). Raised as HashedPasswordException, failing the password match.","triggerScenarios":"Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:88 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-generate the password entry with the expected PBKDF2 format (salt, iterations, hash)","Ensure the entry was produced with PBKDF2WithHmacSHA256/SHA1 consistently","Check the password file for corrupted or truncated lines"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}