{"record":{"id":"cc091fbf3a3474d1","repo":"prestodb/presto","slug":"invalid-pbkdf2-password","errorCode":null,"errorMessage":"Invalid PBKDF2 password","messagePattern":"Invalid PBKDF2 password","errorType":"validation","errorClass":"HashedPasswordException","httpStatus":null,"severity":"error","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java","lineNumber":93,"sourceCode":"        // Fallback to PBKDF2WithHmacSHA1\n        LOG.warn(\"Using deprecated PBKDF2WithHmacSHA1 for password validation.\");\n        return validatePBKDF2Password(inputPassword, password, \"PBKDF2WithHmacSHA1\");\n    }\n\n    private static boolean validatePBKDF2Password(String inputPassword, PBKDF2Password password, String algorithm)\n    {\n        try {\n            KeySpec spec = new PBEKeySpec(inputPassword.toCharArray(), password.salt(), password.iterations(), password.hash().length * 8);\n            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm);\n            byte[] inputHash = keyFactory.generateSecret(spec).getEncoded();\n\n            if (password.hash().length != inputHash.length) {\n                throw new HashedPasswordException(\"PBKDF2 password input is malformed\");\n            }\n            return MessageDigest.isEqual(password.hash(), inputHash);\n        }\n        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {\n            throw new HashedPasswordException(\"Invalid PBKDF2 password\", e);\n        }\n    }\n\n    public static HashingAlgorithm getHashingAlgorithm(String password)\n    {\n        if (password.startsWith(\"$2y\")) {\n            if (getBCryptCost(password) < BCRYPT_MIN_COST) {\n                throw new HashedPasswordException(\"Minimum cost of BCrypt password must be \" + BCRYPT_MIN_COST);\n            }\n            return HashingAlgorithm.BCRYPT;\n        }\n\n        if (password.contains(\":\")) {\n            if (getPBKDF2Iterations(password) < PBKDF2_MIN_ITERATIONS) {\n                throw new HashedPasswordException(\"Minimum iterations of PBKDF2 password must be \" + PBKDF2_MIN_ITERATIONS);\n            }\n            return HashingAlgorithm.PBKDF2;\n        }","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java#L75-L111","documentation":"Catch in validatePBKDF2Password: the JCE rejected the PBKDF2 operation (unknown algorithm or invalid key spec), so password validation cannot proceed. Wrapped in HashedPasswordException; usually indicates a JVM/JCE environment problem or bad stored parameters rather than a wrong password.","triggerScenarios":"Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:93 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the JVM supports PBKDF2WithHmacSHA256/SHA1 via SecretKeyFactory","Check that salt, iterations, and key length from the stored entry are valid","Re-create the password entry with standard parameters"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}