spring-projects/spring-security · error · IllegalArgumentException

Cpu cost parameter must be > 1.

Error message

Cpu cost parameter must be > 1.

What it means

The SCryptPasswordEncoder(int...) constructor enforces scrypt's mathematical constraint that the CPU cost r must exceed 1 (the scrypt formula requires r > 1, and memoryCost == 1 additionally caps cpuCost at 65536). Passing cpuCost <= 1 would produce an invalid or degenerate scrypt configuration, so the constructor fails immediately with this IllegalArgumentException.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/scrypt/SCryptPasswordEncoder.java:99

	private final BytesKeyGenerator saltGenerator;

	/**
	 * Constructs a SCrypt password encoder with the provided parameters.
	 * @param cpuCost cpu cost of the algorithm (as defined in scrypt this is N). must be
	 * power of 2 greater than 1. Default is currently 65,536 or 2^16)
	 * @param memoryCost memory cost of the algorithm (as defined in scrypt this is r)
	 * Default is currently 8.
	 * @param parallelization the parallelization of the algorithm (as defined in scrypt
	 * this is p) Default is currently 1. Note that the implementation does not currently
	 * take advantage of parallelization.
	 * @param keyLength key length for the algorithm (as defined in scrypt this is dkLen).
	 * The default is currently 32.
	 * @param saltLength salt length (as defined in scrypt this is the length of S). The
	 * default is currently 16.
	 */
	public SCryptPasswordEncoder(int cpuCost, int memoryCost, int parallelization, int keyLength, int saltLength) {
		if (cpuCost <= 1) {
			throw new IllegalArgumentException("Cpu cost parameter must be > 1.");
		}
		if (memoryCost == 1 && cpuCost > 65536) {
			throw new IllegalArgumentException("Cpu cost parameter must be > 1 and < 65536.");
		}
		if (memoryCost < 1) {
			throw new IllegalArgumentException("Memory cost must be >= 1.");
		}
		int maxParallel = Integer.MAX_VALUE / (128 * memoryCost * 8);
		if (parallelization < 1 || parallelization > maxParallel) {
			throw new IllegalArgumentException("Parallelisation parameter p must be >= 1 and <= " + maxParallel
					+ " (based on block size r of " + memoryCost + ")");
		}
		if (keyLength < 1 || keyLength > Integer.MAX_VALUE) {
			throw new IllegalArgumentException("Key length must be >= 1 and <= " + Integer.MAX_VALUE);
		}
		if (saltLength < 1 || saltLength > Integer.MAX_VALUE) {
			throw new IllegalArgumentException("Salt length must be >= 1 and <= " + Integer.MAX_VALUE);
		}

View on GitHub (pinned to 96852e8860)

Solutions

1. Use values at or above the defaults: new SCryptPasswordEncoder(16384, 8, 1, 32, 64).
2. Validate configuration before constructing: if (cpuCost > 1) { ... } else fall back to defaults.
3. Check argument order in the five-arg constructor — cpuCost is the first parameter, not keyLength or parallelization.

Example fix

// before
PasswordEncoder e = new SCryptPasswordEncoder(1, 8, 1, 32, 64); // invalid
// after
PasswordEncoder e = new SCryptPasswordEncoder(16384, 8, 1, 32, 64);

if (cpuCost <= 1) cpuCost = 16384;
PasswordEncoder e = new SCryptPasswordEncoder(cpuCost, memoryCost, parallelization, keyLength, saltLength);

try {
    encoder = new SCryptPasswordEncoder(cpuCost, memoryCost, parallelization, keyLength, saltLength);
} catch (IllegalArgumentException e) {
    encoder = new SCryptPasswordEncoder(); // secure defaults
}

When it happens

Trigger: Instantiating new SCryptPasswordEncoder(0|1, memoryCost, parallelization, keyLength, saltLength) or passing a cpuCost resolved from configuration that is 0, 1, or negative.

Common situations: Unset config property defaulting to 0; misunderstanding the parameter and passing parallelization/keyLength values in the wrong slot; attempting to 'disable' cost by setting it to 1.

Related errors

• Iterations value must be greater than zero
• Parallelisation parameter p must be >= 1 and <= {maxParallel
• Cannot apply {configurer} to already built object
• managerPassword is required if managerDn is supplied
• org.springframework.security.config.annotation.method.config

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/587e1b23418cab16. Report an issue: GitHub.