prestodb/presto · error · HashedPasswordException

Invalid PBKDF2 password

Error message

Invalid PBKDF2 password

What it means

Catch in validatePBKDF2Password: the JCE rejected the PBKDF2 operation (unknown algorithm or invalid key spec), so password validation cannot proceed. Wrapped in HashedPasswordException; usually indicates a JVM/JCE environment problem or bad stored parameters rather than a wrong password.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:93

        // Fallback to PBKDF2WithHmacSHA1
        LOG.warn("Using deprecated PBKDF2WithHmacSHA1 for password validation.");
        return validatePBKDF2Password(inputPassword, password, "PBKDF2WithHmacSHA1");
    }

    private static boolean validatePBKDF2Password(String inputPassword, PBKDF2Password password, String algorithm)
    {
        try {
            KeySpec spec = new PBEKeySpec(inputPassword.toCharArray(), password.salt(), password.iterations(), password.hash().length * 8);
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm);
            byte[] inputHash = keyFactory.generateSecret(spec).getEncoded();

            if (password.hash().length != inputHash.length) {
                throw new HashedPasswordException("PBKDF2 password input is malformed");
            }
            return MessageDigest.isEqual(password.hash(), inputHash);
        }
        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
            throw new HashedPasswordException("Invalid PBKDF2 password", e);
        }
    }

    public static HashingAlgorithm getHashingAlgorithm(String password)
    {
        if (password.startsWith("$2y")) {
            if (getBCryptCost(password) < BCRYPT_MIN_COST) {
                throw new HashedPasswordException("Minimum cost of BCrypt password must be " + BCRYPT_MIN_COST);
            }
            return HashingAlgorithm.BCRYPT;
        }

        if (password.contains(":")) {
            if (getPBKDF2Iterations(password) < PBKDF2_MIN_ITERATIONS) {
                throw new HashedPasswordException("Minimum iterations of PBKDF2 password must be " + PBKDF2_MIN_ITERATIONS);
            }
            return HashingAlgorithm.PBKDF2;
        }

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the JVM supports PBKDF2WithHmacSHA256/SHA1 via SecretKeyFactory
2. Check that salt, iterations, and key length from the stored entry are valid
3. Re-create the password entry with standard parameters

When it happens

Trigger: Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:93 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/cc091fbf3a3474d1. Report an issue: GitHub.