k3s-io/k3s · error

hash version %d does not match package version %d

Error message

hash version %d does not match package version %d

What it means

Error "hash version %d does not match package version %d" thrown in k3s-io/k3s.

Source

Thrown at pkg/authenticator/hash/scrypt.go:70

	hash := fmt.Sprintf(hashFormat, Version, salt, s.N, s.R, s.P, enc)

	return hash, nil
}

// VerifyHash will compare a secretKey and a hash, and return nil if they match
func (s SCrypt) VerifyHash(hash, secretKey string) error {
	var (
		version, n uint
		r, p       int
		enc        string
		salt       []byte
	)
	_, err := fmt.Sscanf(hash, hashFormat, &version, &salt, &n, &r, &p, &enc)
	if err != nil {
		return err
	}
	if version != Version {
		return fmt.Errorf("hash version %d does not match package version %d", version, Version)
	}

	dk, err := base64.RawStdEncoding.DecodeString(enc)
	if err != nil {
		return err
	}

	verify, err := scrypt.Key([]byte(secretKey), salt, 1<<n, r, p, len(dk))
	if err != nil {
		return err
	}

	if subtle.ConstantTimeCompare(dk, verify) != 1 {
		return errors.New("hash does not match")
	}

	return nil
}

View on GitHub (pinned to 6ba341e396)

When it happens

Trigger: Thrown at pkg/authenticator/hash/scrypt.go:70 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of k3s-io/k3s@6ba341e396 (2026-08-15). Data as JSON: /api/errors/4ac9583212acd276. Report an issue: GitHub.