{"record":{"id":"443d64c7224df76d","repo":"spring-projects/spring-security","slug":"parallelisation-parameter-p-must-be-1-and-m","errorCode":null,"errorMessage":"Parallelisation parameter p must be >= 1 and <= {maxParallel} (based on block size r of {memoryCost})","messagePattern":"Parallelisation parameter p must be >= 1 and <= (.+?) \\(based on block size r of (.+?)\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java","lineNumber":109,"sourceCode":"\t * take advantage of parallelization.\n\t * @param keyLength key length for the algorithm (as defined in scrypt this is dkLen).\n\t * The default is currently 32.\n\t * @param saltLength salt length (as defined in scrypt this is the length of S). The\n\t * default is currently 16.\n\t */\n\tpublic SCryptPasswordEncoder(int cpuCost, int memoryCost, int parallelization, int keyLength, int saltLength) {\n\t\tif (cpuCost <= 1) {\n\t\t\tthrow new IllegalArgumentException(\"Cpu cost parameter must be > 1.\");\n\t\t}\n\t\tif (memoryCost == 1 && cpuCost > 65536) {\n\t\t\tthrow new IllegalArgumentException(\"Cpu cost parameter must be > 1 and < 65536.\");\n\t\t}\n\t\tif (memoryCost < 1) {\n\t\t\tthrow new IllegalArgumentException(\"Memory cost must be >= 1.\");\n\t\t}\n\t\tint maxParallel = Integer.MAX_VALUE / (128 * memoryCost * 8);\n\t\tif (parallelization < 1 || parallelization > maxParallel) {\n\t\t\tthrow new IllegalArgumentException(\"Parallelisation parameter p must be >= 1 and <= \" + maxParallel\n\t\t\t\t\t+ \" (based on block size r of \" + memoryCost + \")\");\n\t\t}\n\t\tif (keyLength < 1 || keyLength > Integer.MAX_VALUE) {\n\t\t\tthrow new IllegalArgumentException(\"Key length must be >= 1 and <= \" + Integer.MAX_VALUE);\n\t\t}\n\t\tif (saltLength < 1 || saltLength > Integer.MAX_VALUE) {\n\t\t\tthrow new IllegalArgumentException(\"Salt length must be >= 1 and <= \" + Integer.MAX_VALUE);\n\t\t}\n\t\tthis.cpuCost = cpuCost;\n\t\tthis.memoryCost = memoryCost;\n\t\tthis.parallelization = parallelization;\n\t\tthis.keyLength = keyLength;\n\t\tthis.saltGenerator = KeyGenerators.secureRandom(saltLength);\n\t}\n\n\t/**\n\t * Constructs a SCrypt password encoder with cpu cost of 16,384, memory cost of 8,\n\t * parallelization of 1, a key length of 32 and a salt length of 64 bytes.","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java#L91-L127","documentation":"scrypt's parallelization factor p must be >= 1 and bounded above by maxParallel = Integer.MAX_VALUE / (128 * r * 8), derived from the scrypt block size. The constructor computes this bound and throws IllegalArgumentException when p is outside it, preventing integer overflow and invalid scrypt invocations.","triggerScenarios":"`new SCryptPasswordEncoder(cpuCost, memoryCost, parallelization, ...)` with parallelization < 1 or > Integer.MAX_VALUE/(128*memoryCost*8).","commonSituations":"Passing 0 for p from a default config; unreasonably large p values copied from tuning guides without checking the bound; the message reveals the actual maxParallel so developers can clamp to it.","solutions":["Set parallelization >= 1 (default is 1 in the library).","Clamp p to the max stated in the exception message for the chosen memoryCost.","If a higher p is needed, decrease memoryCost (r) to raise the allowed maximum."],"exampleFix":"// before\nnew SCryptPasswordEncoder(16384, 8, 0, 32, 64);\n// after\nnew SCryptPasswordEncoder(16384, 8, 1, 32, 64);","handlingStrategy":"validation","validationCode":"int maxParallel = Integer.MAX_VALUE / (128 * memoryCost * 8);\nif (p < 1 || p > maxParallel) {\n    p = Math.max(1, Math.min(p, maxParallel));\n}\nnew SCryptPasswordEncoder(cpuCost, memoryCost, p, keyLen, saltLen);","typeGuard":null,"tryCatchPattern":"try {\n    encoder = new SCryptPasswordEncoder(cpuCost, r, p, keyLen, saltLen);\n} catch (IllegalArgumentException e) {\n    encoder = new SCryptPasswordEncoder(cpuCost, r, 1, keyLen, saltLen); // safe p=1\n}","preventionTips":["Keep p = 1 unless you have a reason.","Clamp p to the bound derived from r.","Read the max from the exception message when tuning."],"tags":["java","spring-security","password-hashing","validation","scrypt"],"backgroundTag":"argument-out-of-range","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}