prestodb/presto · error · HashedPasswordException

PBKDF2 password input is malformed

Error message

PBKDF2 password input is malformed

What it means

Guard in validatePBKDF2Password: the stored PBKDF2 record's derived hash length does not match the recomputed input hash length, so the stored entry is structurally malformed (wrong fields or wrong algorithm parameters). Raised as HashedPasswordException, failing the password match.

Source

Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:88

        // Validate using PBKDF2WithHmacSHA256
        if (validatePBKDF2Password(inputPassword, password, "PBKDF2WithHmacSHA256")) {
            return true;
        }

        // Fallback to PBKDF2WithHmacSHA1
        LOG.warn("Using deprecated PBKDF2WithHmacSHA1 for password validation.");
        return validatePBKDF2Password(inputPassword, password, "PBKDF2WithHmacSHA1");
    }

    private static boolean validatePBKDF2Password(String inputPassword, PBKDF2Password password, String algorithm)
    {
        try {
            KeySpec spec = new PBEKeySpec(inputPassword.toCharArray(), password.salt(), password.iterations(), password.hash().length * 8);
            SecretKeyFactory keyFactory = SecretKeyFactory.getInstance(algorithm);
            byte[] inputHash = keyFactory.generateSecret(spec).getEncoded();

            if (password.hash().length != inputHash.length) {
                throw new HashedPasswordException("PBKDF2 password input is malformed");
            }
            return MessageDigest.isEqual(password.hash(), inputHash);
        }
        catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
            throw new HashedPasswordException("Invalid PBKDF2 password", e);
        }
    }

    public static HashingAlgorithm getHashingAlgorithm(String password)
    {
        if (password.startsWith("$2y")) {
            if (getBCryptCost(password) < BCRYPT_MIN_COST) {
                throw new HashedPasswordException("Minimum cost of BCrypt password must be " + BCRYPT_MIN_COST);
            }
            return HashingAlgorithm.BCRYPT;
        }

        if (password.contains(":")) {

View on GitHub (pinned to 55bb57d202)

Solutions

1. Re-generate the password entry with the expected PBKDF2 format (salt, iterations, hash)
2. Ensure the entry was produced with PBKDF2WithHmacSHA256/SHA1 consistently
3. Check the password file for corrupted or truncated lines

When it happens

Trigger: Thrown at presto-password-authenticators/src/main/java/com/facebook/presto/password/file/EncryptionUtil.java:88 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/409d765296523e5b. Report an issue: GitHub.