{"record":{"id":"dbf8cd70c2a77260","repo":"prestodb/presto","slug":"minimum-iterations-of-pbkdf2-password-must-be","errorCode":null,"errorMessage":"Minimum iterations of PBKDF2 password must be ","messagePattern":"Minimum iterations of PBKDF2 password must be ","errorType":"validation","errorClass":"HashedPasswordException","httpStatus":null,"severity":"error","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java","lineNumber":108,"sourceCode":"            return MessageDigest.isEqual(password.hash(), inputHash);\n        }\n        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {\n            throw new HashedPasswordException(\"Invalid PBKDF2 password\", e);\n        }\n    }\n\n    public static HashingAlgorithm getHashingAlgorithm(String password)\n    {\n        if (password.startsWith(\"$2y\")) {\n            if (getBCryptCost(password) < BCRYPT_MIN_COST) {\n                throw new HashedPasswordException(\"Minimum cost of BCrypt password must be \" + BCRYPT_MIN_COST);\n            }\n            return HashingAlgorithm.BCRYPT;\n        }\n\n        if (password.contains(\":\")) {\n            if (getPBKDF2Iterations(password) < PBKDF2_MIN_ITERATIONS) {\n                throw new HashedPasswordException(\"Minimum iterations of PBKDF2 password must be \" + PBKDF2_MIN_ITERATIONS);\n            }\n            return HashingAlgorithm.PBKDF2;\n        }\n\n        throw new HashedPasswordException(\"Password hashing algorithm cannot be determined\");\n    }\n\n    private static class PBKDF2Password\n    {\n        private final int iterations;\n        private final byte[] salt;\n        private final byte[] hash;\n\n        private PBKDF2Password(int iterations, byte[] salt, byte[] hash)\n        {\n            this.iterations = iterations;\n            this.salt = requireNonNull(salt, \"salt is null\");\n            this.hash = requireNonNull(hash, \"hash is null\");","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java#L90-L126","documentation":"Policy guard in getHashingAlgorithm: a PBKDF2-formatted password entry declares an iteration count below PBKDF2_MIN_ITERATIONS (1000), which is rejected as too weak. The message includes the required minimum; the entry must be regenerated with more iterations.","triggerScenarios":"Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the PBKDF2 password entry with at least 1000 iterations","Use a modern iteration count (e.g. tens of thousands) when creating password file entries"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}