{"record":{"id":"6db6f4820b4b9d3e","repo":"jstedfast/MailKit","slug":"incorrecthash","errorCode":"IncorrectHash","errorMessage":"Server response did not contain the expected hash.","messagePattern":"Server response did not contain the expected hash\\.","errorType":"error_code","errorClass":"SaslException","httpStatus":null,"severity":"error","filePath":"MailKit/Security/SaslMechanismDigestMd5.cs","lineNumber":173,"sourceCode":"\t\t\t\tstate = LoginState.Final;\n\n\t\t\t\treturn response.Encode (encoding);\n\t\t\tcase LoginState.Final:\n\t\t\t\tif (token == null || token.Length == 0)\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.MissingChallenge, \"Server response did not contain any authentication data.\");\n\n\t\t\t\tvar text = encoding!.GetString (token, startIndex, length);\n\t\t\t\tstring? key, value;\n\n\t\t\t\tif (!DigestChallenge.TryParseKeyValuePair (text, out key, out value))\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.IncompleteChallenge, \"Server response contained incomplete authentication data.\");\n\n\t\t\t\tif (!key.Equals (\"rspauth\", StringComparison.OrdinalIgnoreCase))\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.InvalidChallenge, \"Server response contained invalid data.\");\n\n\t\t\t\tvar expected = response!.ComputeHash (encoding, Credentials.Password, false);\n\t\t\t\tif (value != expected)\n\t\t\t\t\tthrow new SaslException (MechanismName, SaslErrorCode.IncorrectHash, \"Server response did not contain the expected hash.\");\n\n\t\t\t\tIsAuthenticated = true;\n\t\t\t\tbreak;\n\t\t\t}\n\n\t\t\treturn null;\n\t\t}\n\n\t\t/// <summary>\n\t\t/// Reset the state of the SASL mechanism.\n\t\t/// </summary>\n\t\t/// <remarks>\n\t\t/// Resets the state of the SASL mechanism.\n\t\t/// </remarks>\n\t\tpublic override void Reset ()\n\t\t{\n\t\t\tstate = LoginState.Auth;\n\t\t\tchallenge = null;","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/jstedfast/MailKit/blob/9d3859a7855e3e17582c07fd01972b8e262bf176/MailKit/Security/SaslMechanismDigestMd5.cs#L155-L191","documentation":"After parsing the required 'rspauth' directive in the final DIGEST-MD5 response, MailKit recomputes the expected hash from the Credentials.Password and compares it to the value the server sent. This SaslException (SaslErrorCode.IncorrectHash) is thrown when the server's rspauth value does not match the locally computed hash, meaning the server failed to prove it knows the shared secret.","triggerScenarios":"Challenge receives a final token whose rspauth value differs from response.ComputeHash(encoding, Credentials.Password, false) — i.e. wrong password supplied, or the server computed its hash with different credentials/charset/nonce values.","commonSituations":"Typo'd or stale password in Credentials; server and client disagreeing on charset (e.g. UTF-8 vs ISO-8859-1) for non-ASCII passwords; server bug computing rspauth with a different nonce/cnonce; account password changed mid-session.","solutions":["Verify the username and password passed to Authenticate/Credentials are correct for the target server.","Check for non-ASCII characters in the password and ensure consistent charset handling (try ASCII-safe password to confirm).","Confirm the server implementation conforms to RFC 2831 rspauth computation; test with another client.","Re-check that the account password hasn't changed and any credential store/cache is up to date.","Switch to a different SASL mechanism (e.g. PLAIN over TLS) to sidestep DIGEST-MD5 hash negotiation issues."],"exampleFix":"// before: wrong password silently produces IncorrectHash\nvar digest = new SaslMechanismDigestMd5 (\"user\", \"paasword\"); // typo\nawait client.Authenticate (digest);\n\n// after: correct credentials from secure source\nvar digest = new SaslMechanismDigestMd5 (\"user\", passwordFromSecretStore);\nawait client.Authenticate (digest);","handlingStrategy":"try-catch","validationCode":"// Pre-validate credentials before the exchange\nif (string.IsNullOrEmpty (password) || password != confirmedPassword)\n\tthrow new InvalidOperationException (\"Password missing or mismatched; fix credentials before authenticating\");","typeGuard":null,"tryCatchPattern":"try {\n\tawait client.Authenticate (new SaslMechanismDigestMd5 (user, pass));\n} catch (SaslException ex) when (ex.ErrorCode == SaslErrorCode.IncorrectHash) {\n\t// server rspauth did not match: wrong password or charset issue\n\tlogger.LogError (\"Server failed rspauth verification; check credentials/charset\");\n\tthrow;\n}","preventionTips":["Double-check credentials against the authoritative account store before authenticating.","Use ASCII-safe passwords or confirm charset agreement for non-ASCII passwords.","Verify the server's DIGEST-MD5 implementation against a reference client.","Rotate credentials carefully; re-authenticate after password changes."],"tags":["sasl","digest-md5","authentication","hash"],"backgroundTag":"checksum-mismatch","analyzedSha":"9d3859a7855e3e17582c07fd01972b8e262bf176","analyzedAt":"2026-09-15T15:46:11.592Z","contentChangedAt":"2026-09-15T15:46:11.592Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}