{"record":{"id":"6c7e1d25af85094c","repo":"apache/cassandra","slug":"hash-algorithm-not-found-algorithm","errorCode":null,"errorMessage":"Hash algorithm not found: ${algorithm}","messagePattern":"Hash algorithm not found: (.+?)","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/functions/masking/HashMaskingFunction.java","lineNumber":128,"sourceCode":"        MessageDigest digest = DIGESTS.get(cacheKey);\n        if (digest == null)\n        {\n            digest = messageDigest(UTF8Type.instance.compose(cacheKey));\n            DIGESTS.put(cacheKey.duplicate(), digest);\n        }\n        return digest;\n    }\n\n    @VisibleForTesting\n    static MessageDigest messageDigest(String algorithm)\n    {\n        try\n        {\n            return MessageDigest.getInstance(algorithm);\n        }\n        catch (NoSuchAlgorithmException e)\n        {\n            throw new InvalidRequestException(\"Hash algorithm not found: \" + algorithm);\n        }\n    }\n\n    /** @return a {@link FunctionFactory} to build new {@link HashMaskingFunction}s. */\n    public static FunctionFactory factory()\n    {\n        return new MaskingFunction.Factory(NAME,\n                                           FunctionParameter.anyType(false),\n                                           FunctionParameter.optional(FunctionParameter.fixed(CQL3Type.Native.TEXT)))\n        {\n            @Override\n            protected NativeFunction doGetOrCreateFunction(List<AbstractType<?>> argTypes, AbstractType<?> receiverType)\n            {\n                switch (argTypes.size())\n                {\n                    case 1:\n                        return new HashMaskingFunction(name, argTypes.get(0), false);\n                    case 2:","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/functions/masking/HashMaskingFunction.java#L110-L146","documentation":"HashMaskingFunction.messageDigest resolves a JCA MessageDigest for the algorithm name given to mask_hash. If the JVM has no registered provider for that algorithm, the NoSuchAlgorithmException is translated into this InvalidRequestException naming the unsupported algorithm.","triggerScenarios":"Using mask_hash('mycolumn', 'SHA3') or any algorithm name that is not available in the JVM's MessageDigest provider set (e.g. a typo like 'sha1 ' or 'MD6', or a non-standard algorithm on a stripped-down JRE).","commonSituations":"Typos in the algorithm argument; using algorithm names valid on newer JDKs while running Cassandra on an older Java 11 JRE; running on a custom JRE with fewer security providers.","solutions":["Use a standard algorithm supported by the JVM, e.g. 'MD5', 'SHA-1', 'SHA-256', 'SHA-512'","Check available algorithms with java.security.Security.getAlgorithms(\"MessageDigest\") and pick one from the list","If a non-default algorithm is required, run on a JDK that provides it or add the security provider"],"exampleFix":"// before\nCREATE TABLE users (email text MASKED WITH mask_hash(email, 'SHA3'));\n// after\nCREATE TABLE users (email text MASKED WITH mask_hash(email, 'SHA-256'));","handlingStrategy":"validation","validationCode":"Set<String> available = java.security.Security.getAlgorithms(\"MessageDigest\");\nif (!available.contains(\"SHA-256\")) throw new IllegalArgumentException(\"hash algorithm not available in this JVM\");","typeGuard":null,"tryCatchPattern":"try {\n    session.execute(\"CREATE TABLE ... MASKED WITH mask_hash(col, 'SHA-256')\");\n} catch (InvalidRequestException e) {\n    if (e.getMessage().startsWith(\"Hash algorithm not found\")) {\n        // retry with a JVM-supported algorithm\n    }\n}","preventionTips":["Stick to universally supported names: MD5, SHA-1, SHA-256, SHA-512","Note the exact JVM algorithm names (SHA-256, not SHA256)","Verify algorithm availability on the target JDK version before deploying masking DDL"],"tags":["cassandra","masking","hash"],"backgroundTag":"invalid-enum-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}