{"record":{"id":"a846cc152ff5fd81","repo":"spring-projects/spring-security","slug":"could-not-create-hash","errorCode":null,"errorMessage":"Could not create hash","messagePattern":"Could not create hash","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java","lineNumber":232,"sourceCode":"\t\treturn MessageDigest.isEqual(digested, encodedNonNullPassword(rawPassword, salt));\n\t}\n\n\tprivate byte[] decode(String encodedBytes) {\n\t\tif (this.encodeHashAsBase64) {\n\t\t\treturn Base64.getDecoder().decode(encodedBytes);\n\t\t}\n\t\treturn Hex.decode(encodedBytes);\n\t}\n\n\tprivate byte[] encodedNonNullPassword(CharSequence rawPassword, byte[] salt) {\n\t\ttry {\n\t\t\tPBEKeySpec spec = new PBEKeySpec(rawPassword.toString().toCharArray(),\n\t\t\t\t\tEncodingUtils.concatenate(salt, this.secret), this.iterations, this.hashWidth);\n\t\t\tSecretKeyFactory skf = SecretKeyFactory.getInstance(this.algorithm);\n\t\t\treturn EncodingUtils.concatenate(salt, skf.generateSecret(spec).getEncoded());\n\t\t}\n\t\tcatch (GeneralSecurityException ex) {\n\t\t\tthrow new IllegalStateException(\"Could not create hash\", ex);\n\t\t}\n\t}\n\n\t/**\n\t * The Algorithm used for creating the {@link SecretKeyFactory}.\n\t *\n\t * @since 5.0\n\t */\n\tpublic enum SecretKeyFactoryAlgorithm {\n\n\t\tPBKDF2WithHmacSHA1, PBKDF2WithHmacSHA256, PBKDF2WithHmacSHA512\n\n\t}\n\n}\n","sourceCodeStart":214,"sourceCodeEnd":248,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/password/Pbkdf2PasswordEncoder.java#L214-L248","documentation":"encodedNonNullPassword builds the PBEKeySpec and derives the hash via SecretKeyFactory; any GeneralSecurityException raised there is wrapped in this IllegalStateException(\"Could not create hash\"). Since the algorithm was already validated in setAlgorithm, this signals an unexpected runtime crypto failure (provider removed mid-flight, invalid key spec, etc.) rather than normal user error.","triggerScenarios":"Calling encode() or matches() when SecretKeyFactory.getInstance(this.algorithm) or skf.generateSecret(spec) fails at runtime — e.g. the provider backing the algorithm was deregistered, or hashWidth/iterations produce an invalid PBEKeySpec.","commonSituations":"Dynamic provider manipulation (Security.removeProvider) at runtime; exotic hashWidth values on restrictive providers; JVM security policy blocking the crypto operation.","solutions":["Inspect the wrapped cause (ex.getCause()) in the stack trace to find the underlying GeneralSecurityException.","Verify the JCA provider supplying the PBKDF2 algorithm is still installed (Security.getProviders()).","Keep algorithm/hashWidth within tested combinations — set the algorithm via setAlgorithm so it is validated up front, and avoid removing providers at runtime."],"exampleFix":"// before (application code)\nSecurity.removeProvider(\"SunJCE\"); // breaks later PBKDF2 calls\n// after\n// leave default providers installed; only add providers, never remove","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    hash = encoder.encode(raw);\n} catch (IllegalStateException e) {\n    if (e.getMessage().equals(\"Could not create hash\")) {\n        log.error(\"PBKDF2 failure\", e.getCause()); // inspect GeneralSecurityException cause\n        throw e;\n    }\n}","preventionTips":["Never call Security.removeProvider at runtime; only append providers.","Always set the algorithm through setAlgorithm so provider support is validated before hashing.","Log and monitor e.getCause() — the wrapped GeneralSecurityException names the real problem."],"tags":["java","spring-security","pbkdf2","crypto"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}