{"record":{"id":"907fe080ace32844","repo":"spring-projects/spring-security","slug":"invalid-algorithm-algorithmname","errorCode":null,"errorMessage":"Invalid algorithm '{algorithmName}'.","messagePattern":"Invalid algorithm '(.+?)'\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java","lineNumber":178,"sourceCode":"\t * \"https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#SecretKeyFactory\">SecretKeyFactory\n\t * Algorithms</a>\n\t * @param secretKeyFactoryAlgorithm the algorithm to use (i.e.\n\t * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1},\n\t * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256},\n\t * {@code SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512})\n\t * @since 5.0\n\t */\n\tpublic void setAlgorithm(SecretKeyFactoryAlgorithm secretKeyFactoryAlgorithm) {\n\t\tif (secretKeyFactoryAlgorithm == null) {\n\t\t\tthrow new IllegalArgumentException(\"secretKeyFactoryAlgorithm cannot be null\");\n\t\t}\n\t\tString algorithmName = secretKeyFactoryAlgorithm.name();\n\t\ttry {\n\t\t\tSecretKeyFactory.getInstance(algorithmName);\n\t\t\tthis.algorithm = algorithmName;\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalArgumentException(\"Invalid algorithm '\" + algorithmName + \"'.\", ex);\n\t\t}\n\t\tif (this.overrideHashWidth) {\n\t\t\tthis.hashWidth = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.equals(secretKeyFactoryAlgorithm) ? 160\n\t\t\t\t\t: SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256.equals(secretKeyFactoryAlgorithm) ? 256 : 512;\n\t\t}\n\t}\n\n\t/**\n\t * Sets if the resulting hash should be encoded as Base64. The default is false which\n\t * means it will be encoded in Hex.\n\t * @param encodeHashAsBase64 true if encode as Base64, false if should use Hex\n\t * (default)\n\t */\n\tpublic void setEncodeHashAsBase64(boolean encodeHashAsBase64) {\n\t\tthis.encodeHashAsBase64 = encodeHashAsBase64;\n\t}\n\n\t@Override","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java#L160-L196","documentation":"setAlgorithm validates the chosen algorithm by attempting SecretKeyFactory.getInstance(algorithmName); if no provider supplies it, this IllegalArgumentException(\"Invalid algorithm '<name>'.\") is thrown. It means the JVM cannot create a SecretKeyFactory for the requested PBKDF2 variant — typically because the JDK is too old (PBKDF2WithHmacSHA256/512 need Java 8u+/9+) or a restricted provider set is installed.","triggerScenarios":"Calling setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256) or PBKDF2WithHmacSHA512 on a JDK whose providers lack those transformations (older Java 7/early 8, or FIPS-limited providers).","commonSituations":"Deploying to an older JVM after developing on a modern JDK; vendor JREs or FIPS configurations that only expose PBKDF2WithHmacSHA1; misconfigured java.security provider list.","solutions":["Upgrade to a JDK that supports the algorithm (Oracle/OpenJDK 8u+ or 11+ for SHA-256/SHA-512 PBKDF2).","Fall back to SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1, which is universally available, if the runtime cannot be upgraded.","Register a provider (e.g. BouncyCastle) that supplies the missing SecretKeyFactory transformation."],"exampleFix":"// before\nencoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512); // Java 7\n// after\nencoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1); // works everywhere","handlingStrategy":"validation","validationCode":"String name = algo.name();\nboolean available = java.security.Security.getAlgorithms(\"SecretKeyFactory\").contains(name);\nif (!available) algo = SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1;\nencoder.setAlgorithm(algo);","typeGuard":null,"tryCatchPattern":"try {\n    encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA512);\n} catch (IllegalArgumentException e) {\n    encoder.setAlgorithm(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1); // universal fallback\n}","preventionTips":["Document the minimum JDK (8u+/11+ for SHA-256/512 PBKDF2) and verify it in CI and at startup.","Prefer PBKDF2WithHmacSHA1 for deployments targeting heterogeneous/legacy JREs."],"tags":["java","spring-security","pbkdf2","jvm"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}