{"record":{"id":"4f408d4526045dd5","repo":"apache/shardingsphere","slug":"unrecognised-hash-algorithm-s","errorCode":null,"errorMessage":"Unrecognised hash algorithm `%s`.","messagePattern":"Unrecognised hash algorithm `(.+?)`\\.","errorType":"exception","errorClass":"FirebirdProtocolException","httpStatus":null,"severity":"critical","filePath":"database/protocol/dialect/firebird/src/main/java/org/apache/shardingsphere/database/protocol/firebird/packet/handshake/FirebirdSRPAuthenticationData.java","lineNumber":207,"sourceCode":"                toBigByteArray(publicKey),\n                serverSessionKey);\n        sessionKey = serverSessionKey;\n        return clientProof;\n    }\n    \n    public String getPublicKeyHex() {\n        return ByteArrayHelper.toHexString(pad(publicKey));\n    }\n    \n    private byte[] clientProofHash(final byte[]... arrays) throws FirebirdProtocolException {\n        try {\n            MessageDigest md = MessageDigest.getInstance(clientProofHashAlgorithm);\n            for (byte[] array : arrays) {\n                md.update(array);\n            }\n            return md.digest();\n        } catch (final NoSuchAlgorithmException ex) {\n            throw new FirebirdProtocolException(\"Unrecognised hash algorithm `%s`.\", clientProofHashAlgorithm);\n        }\n    }\n    \n    /**\n     * Normalizes a login by uppercasing unquoted usernames, or stripping and unescaping (double) quoted user names.\n     *\n     * @param login login to process\n     * @return normalized login\n     */\n    static String normalizeLogin(final String login) {\n        if (login == null || login.isEmpty()) {\n            return login;\n        }\n        if (login.length() > 2 && login.charAt(0) == '\"' && login.charAt(login.length() - 1) == '\"') {\n            return normalizeQuotedLogin(login);\n        }\n        return login.toUpperCase(Locale.ROOT);\n    }","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/apache/shardingsphere/blob/e952770a215630a3659c75d64369168cd3e26b82/database/protocol/dialect/firebird/src/main/java/org/apache/shardingsphere/database/protocol/firebird/packet/handshake/FirebirdSRPAuthenticationData.java#L189-L225","documentation":"Thrown during Firebird SRP (Secure Remote Password) authentication: MessageDigest.getInstance(clientProofHashAlgorithm) failed with NoSuchAlgorithmException, so the configured proof hash algorithm name is not available in the JVM. Firebird SRP variants use SHA-1 (SRP) and SHA-256 (SRP256); the algorithm string must be a JCA-recognized name.","triggerScenarios":"Authenticating with SRP/SRP256 where the negotiated plugin maps to a clientProofHashAlgorithm string the JCA does not recognize — e.g. a plugin name like 'Srp' not translated to 'SHA-1'/'SHA-256', or a JVM without the requested digest provider.","commonSituations":"Mis-mapped plugin-to-algorithm translation when adding a new SRP variant; stripped-down JVMs (limited JCE policy or missing providers); Firebird 3/4 servers advertising SRP variants the proxy maps incorrectly.","solutions":["Check the algorithm string from the exception context; verify MessageDigest.getInstance() accepts it in a plain JVM scratch test","Confirm the server auth plugin is SRP or SRP256 and that the proxy translates it to 'SHA-1' or 'SHA-256' respectively","Run a full JDK (not a trimmed JRE) and ensure the SUN security provider is registered in java.security","If a new Firebird SRP variant is in play, add its algorithm mapping in the SRP authentication data setup and report it upstream"],"exampleFix":"// scratch check: is the algorithm available?\ntry {\n    MessageDigest.getInstance(\"SHA-256\"); // works on a stock JVM\n} catch (NoSuchAlgorithmException e) {\n    // JVM/provider problem: switch JDK or fix provider config\n}","handlingStrategy":"validation","validationCode":"// verify the algorithm exists before auth starts\nprivate static boolean isDigestAvailable(final String algorithm) {\n    try {\n        MessageDigest.getInstance(algorithm);\n        return true;\n    } catch (NoSuchAlgorithmException ex) {\n        return false;\n    }\n}\n// if (!isDigestAvailable(clientProofHashAlgorithm)) -> fail fast with a config error instead of mid-handshake","typeGuard":null,"tryCatchPattern":"try {\n    authData.getPublicKeyHex(); // or the auth flow that computes the proof\n} catch (FirebirdProtocolException ex) {\n    // algorithm string is not JCA-resolvable: check JVM providers / plugin mapping before retrying\n    throw new AuthConfigException(\"SRP hash algorithm unavailable on this JVM\", ex);\n}","preventionTips":["Run a smoke check at startup that MessageDigest supports SHA-1 and SHA-256 on the deployed JVM","Pin server auth plugins to SRP/SRP256 and verify the proxy maps them to JCA names"],"tags":["firebird","authentication","srp","cryptography","jvm-provider"],"backgroundTag":null,"analyzedSha":"e952770a215630a3659c75d64369168cd3e26b82","analyzedAt":"2026-08-14T13:54:53.392Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}