{"record":{"id":"da1a6e87e167aaa3","repo":"prestodb/presto","slug":"minimum-cost-of-bcrypt-password-must-be","errorCode":null,"errorMessage":"Minimum cost of BCrypt password must be ","messagePattern":"Minimum cost of BCrypt password must be ","errorType":"validation","errorClass":"HashedPasswordException","httpStatus":null,"severity":"error","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java","lineNumber":101,"sourceCode":"            KeySpec spec = new PBEKeySpec(inputPassword.toCharArray(), password.salt(), password.iterations(), password.hash().length * 8);\n            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm);\n            byte[] inputHash = keyFactory.generateSecret(spec).getEncoded();\n\n            if (password.hash().length != inputHash.length) {\n                throw new HashedPasswordException(\"PBKDF2 password input is malformed\");\n            }\n            return MessageDigest.isEqual(password.hash(), inputHash);\n        }\n        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {\n            throw new HashedPasswordException(\"Invalid PBKDF2 password\", e);\n        }\n    }\n\n    public static HashingAlgorithm getHashingAlgorithm(String password)\n    {\n        if (password.startsWith(\"$2y\")) {\n            if (getBCryptCost(password) < BCRYPT_MIN_COST) {\n                throw new HashedPasswordException(\"Minimum cost of BCrypt password must be \" + BCRYPT_MIN_COST);\n            }\n            return HashingAlgorithm.BCRYPT;\n        }\n\n        if (password.contains(\":\")) {\n            if (getPBKDF2Iterations(password) < PBKDF2_MIN_ITERATIONS) {\n                throw new HashedPasswordException(\"Minimum iterations of PBKDF2 password must be \" + PBKDF2_MIN_ITERATIONS);\n            }\n            return HashingAlgorithm.PBKDF2;\n        }\n\n        throw new HashedPasswordException(\"Password hashing algorithm cannot be determined\");\n    }\n\n    private static class PBKDF2Password\n    {\n        private final int iterations;\n        private final byte[] salt;","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java#L83-L119","documentation":"Policy guard in getHashingAlgorithm: a $2y-prefixed BCrypt password has a cost factor below BCRYPT_MIN_COST (8), which is considered too weak for password authentication. The exception message embeds the required minimum; the operator must re-hash the password at a compliant cost.","triggerScenarios":"Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:101 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-hash the password with BCrypt cost >= 8","Prefer PBKDF2 or a stronger BCrypt cost factor when generating password file entries"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}