{"record":{"id":"e3aa7f7b456b11b4","repo":"spring-projects/spring-security","slug":"key-length-must-be-1-and-integer-max-value","errorCode":null,"errorMessage":"Key length must be >= 1 and <= {Integer.MAX_VALUE}","messagePattern":"Key length must be >= 1 and <= (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java","lineNumber":113,"sourceCode":"\t * default is currently 16.\n\t */\n\tpublic SCryptPasswordEncoder(int cpuCost, int memoryCost, int parallelization, int keyLength, int saltLength) {\n\t\tif (cpuCost <= 1) {\n\t\t\tthrow new IllegalArgumentException(\"Cpu cost parameter must be > 1.\");\n\t\t}\n\t\tif (memoryCost == 1 && cpuCost > 65536) {\n\t\t\tthrow new IllegalArgumentException(\"Cpu cost parameter must be > 1 and < 65536.\");\n\t\t}\n\t\tif (memoryCost < 1) {\n\t\t\tthrow new IllegalArgumentException(\"Memory cost must be >= 1.\");\n\t\t}\n\t\tint maxParallel = Integer.MAX_VALUE / (128 * memoryCost * 8);\n\t\tif (parallelization < 1 || parallelization > maxParallel) {\n\t\t\tthrow new IllegalArgumentException(\"Parallelisation parameter p must be >= 1 and <= \" + maxParallel\n\t\t\t\t\t+ \" (based on block size r of \" + memoryCost + \")\");\n\t\t}\n\t\tif (keyLength < 1 || keyLength > Integer.MAX_VALUE) {\n\t\t\tthrow new IllegalArgumentException(\"Key length must be >= 1 and <= \" + Integer.MAX_VALUE);\n\t\t}\n\t\tif (saltLength < 1 || saltLength > Integer.MAX_VALUE) {\n\t\t\tthrow new IllegalArgumentException(\"Salt length must be >= 1 and <= \" + Integer.MAX_VALUE);\n\t\t}\n\t\tthis.cpuCost = cpuCost;\n\t\tthis.memoryCost = memoryCost;\n\t\tthis.parallelization = parallelization;\n\t\tthis.keyLength = keyLength;\n\t\tthis.saltGenerator = KeyGenerators.secureRandom(saltLength);\n\t}\n\n\t/**\n\t * Constructs a SCrypt password encoder with cpu cost of 16,384, memory cost of 8,\n\t * parallelization of 1, a key length of 32 and a salt length of 64 bytes.\n\t * @return the {@link SCryptPasswordEncoder}\n\t * @since 5.8\n\t * @deprecated Use {@link #defaultsForSpringSecurity_v5_8()} instead\n\t */","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java#L95-L131","documentation":"The derived-key length must be a positive int within range; since values above Integer.MAX_VALUE cannot even be expressed as an int, the check effectively rejects keyLength < 1. SCryptPasswordEncoder throws IllegalArgumentException so no encoder is created with a nonsense key length.","triggerScenarios":"`new SCryptPasswordEncoder(cpuCost, memoryCost, parallelization, keyLength, saltLength)` with keyLength < 1 (values > Integer.MAX_VALUE are impossible for an int parameter).","commonSituations":"keyLength read from config defaulting to 0 or -1; using 0 meaning 'default' when the API requires an explicit positive length; accidentally passing byte-vs-bit confusion like 0.","solutions":["Pass a positive keyLength in bytes (e.g. 32 for 256-bit keys).","Validate the configured value is >= 1 before constructing.","Use the no-arg constructor for defaults (keyLength 32)."],"exampleFix":"// before\nnew SCryptPasswordEncoder(16384, 8, 1, 0, 64);\n// after\nnew SCryptPasswordEncoder(16384, 8, 1, 32, 64);","handlingStrategy":"validation","validationCode":"if (keyLength < 1 || keyLength > Integer.MAX_VALUE) {\n    throw new IllegalArgumentException(\"keyLength must be >= 1: \" + keyLength);\n}\nnew SCryptPasswordEncoder(cpuCost, memoryCost, p, keyLength, saltLen);","typeGuard":null,"tryCatchPattern":"try {\n    encoder = new SCryptPasswordEncoder(cpuCost, r, p, keyLength, saltLen);\n} catch (IllegalArgumentException e) {\n    encoder = new SCryptPasswordEncoder(); // defaults: keyLength 32\n}","preventionTips":["Use 32 (256-bit) as a standard key length.","Treat 0/absent config as 'use default', not a literal 0.","Validate int parameters post-parse."],"tags":["java","spring-security","password-hashing","validation"],"backgroundTag":"argument-out-of-range","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}