prestodb/presto · error · HashedPasswordException

Minimum iterations of PBKDF2 password must be

Error message

Minimum iterations of PBKDF2 password must be 

What it means

Policy guard in getHashingAlgorithm: a PBKDF2-formatted password entry declares an iteration count below PBKDF2_MIN_ITERATIONS (1000), which is rejected as too weak. The message includes the required minimum; the entry must be regenerated with more iterations.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:108

            return MessageDigest.isEqual(password.hash(), inputHash);
        }
        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
            throw new HashedPasswordException("Invalid PBKDF2 password", e);
        }
    }

    public static HashingAlgorithm getHashingAlgorithm(String password)
    {
        if (password.startsWith("$2y")) {
            if (getBCryptCost(password) < BCRYPT_MIN_COST) {
                throw new HashedPasswordException("Minimum cost of BCrypt password must be " + BCRYPT_MIN_COST);
            }
            return HashingAlgorithm.BCRYPT;
        }

        if (password.contains(":")) {
            if (getPBKDF2Iterations(password) < PBKDF2_MIN_ITERATIONS) {
                throw new HashedPasswordException("Minimum iterations of PBKDF2 password must be " + PBKDF2_MIN_ITERATIONS);
            }
            return HashingAlgorithm.PBKDF2;
        }

        throw new HashedPasswordException("Password hashing algorithm cannot be determined");
    }

    private static class PBKDF2Password
    {
        private final int iterations;
        private final byte[] salt;
        private final byte[] hash;

        private PBKDF2Password(int iterations, byte[] salt, byte[] hash)
        {
            this.iterations = iterations;
            this.salt = requireNonNull(salt, "salt is null");
            this.hash = requireNonNull(hash, "hash is null");

View on GitHub (pinned to 55bb57d202)

Solutions

1. Regenerate the PBKDF2 password entry with at least 1000 iterations
2. Use a modern iteration count (e.g. tens of thousands) when creating password file entries

When it happens

Trigger: Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:108 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/dbf8cd70c2a77260. Report an issue: GitHub.