prestodb/presto · error · HashedPasswordException

Minimum cost of BCrypt password must be

Error message

Minimum cost of BCrypt password must be 

What it means

Policy guard in getHashingAlgorithm: a $2y-prefixed BCrypt password has a cost factor below BCRYPT_MIN_COST (8), which is considered too weak for password authentication. The exception message embeds the required minimum; the operator must re-hash the password at a compliant cost.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:101

            KeySpec spec = new PBEKeySpec(inputPassword.toCharArray(), password.salt(), password.iterations(), password.hash().length * 8);
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm);
            byte[] inputHash = keyFactory.generateSecret(spec).getEncoded();

            if (password.hash().length != inputHash.length) {
                throw new HashedPasswordException("PBKDF2 password input is malformed");
            }
            return MessageDigest.isEqual(password.hash(), inputHash);
        }
        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
            throw new HashedPasswordException("Invalid PBKDF2 password", e);
        }
    }

    public static HashingAlgorithm getHashingAlgorithm(String password)
    {
        if (password.startsWith("$2y")) {
            if (getBCryptCost(password) < BCRYPT_MIN_COST) {
                throw new HashedPasswordException("Minimum cost of BCrypt password must be " + BCRYPT_MIN_COST);
            }
            return HashingAlgorithm.BCRYPT;
        }

        if (password.contains(":")) {
            if (getPBKDF2Iterations(password) < PBKDF2_MIN_ITERATIONS) {
                throw new HashedPasswordException("Minimum iterations of PBKDF2 password must be " + PBKDF2_MIN_ITERATIONS);
            }
            return HashingAlgorithm.PBKDF2;
        }

        throw new HashedPasswordException("Password hashing algorithm cannot be determined");
    }

    private static class PBKDF2Password
    {
        private final int iterations;
        private final byte[] salt;

View on GitHub (pinned to 55bb57d202)

Solutions

1. Re-hash the password with BCrypt cost >= 8
2. Prefer PBKDF2 or a stronger BCrypt cost factor when generating password file entries

When it happens

Trigger: Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:101 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/da1a6e87e167aaa3. Report an issue: GitHub.