Submit Feedback
Legacy Knowledge Base
Published Jun. 30, 2025

High CPU and memory use with stacktraces associated to password encryption

Written By

Ricardo Couso

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • The environment starts using a large amount of CPU and also memory.
  • Reviewing thread dumps taking during that time, there are many threads associated to PBKDF2PasswordEncryptor.encrypt, such as: 
    "https-jsse-nio-8443-exec-5" #115 daemon prio=5 os_prio=0 cpu=274186.74ms elapsed=911.21s tid=0x00007fdc336f0800 nid=0xbca3c runnable [0x00007fdacebda000]
    java.lang.Thread.State: RUNNABLE
      at java.security.MessageDigest$Delegate.engineUpdate(java.base@11.0.24/MessageDigest.java:623)
      at java.security.MessageDigest.update(java.base@11.0.24/MessageDigest.java:355)
      at com.sun.crypto.provider.HmacCore.engineDoFinal(java.base@11.0.24/HmacCore.java:223)
      at javax.crypto.Mac.doFinal(java.base@11.0.24/Mac.java:581)
      at javax.crypto.Mac.doFinal(java.base@11.0.24/Mac.java:624)
      at com.sun.crypto.provider.PBKDF2KeyImpl.deriveKey(java.base@11.0.24/PBKDF2KeyImpl.java:201)
      at com.sun.crypto.provider.PBKDF2KeyImpl.<init>(java.base@11.0.24/PBKDF2KeyImpl.java:117)
      at com.sun.crypto.provider.PBKDF2Core.engineGenerateSecret(java.base@11.0.24/PBKDF2Core.java:69)
      at javax.crypto.SecretKeyFactory.generateSecret(java.base@11.0.24/SecretKeyFactory.java:344)
      at com.liferay.portal.security.password.encryptor.internal.PBKDF2PasswordEncryptor.encrypt(PBKDF2PasswordEncryptor.java:84)
      at com.liferay.portal.security.password.encryptor.internal.CompositePasswordEncryptor.encrypt(CompositePasswordEncryptor.java:90)
      at com.liferay.portal.security.password.encryptor.internal.BasePasswordEncryptor.encrypt(BasePasswordEncryptor.java:44)
  • Reviewing heap dumps taken during that time, there are many array objects of hundreds of MB in size associated to the same stacktraces.

Environment

  • Liferay DXP 7.4
  • Liferay Quarterly Release

Resolution

  • This issue can occur if there are users trying to login whose password algorithm is a legacy one but the portal property passwords.encryption.algorithm.legacy is not informed.
  • The portal property passwords.encryption.algorithm defines the current password encryption algorithm and has the default value passwords.encryption.algorithm=PBKDF2WithHmacSHA1/160/1300000, although some other options are available. 
  • Nevertheless, some users might still have their password encrypted with one of the legacy encryption algorithms, indicated via the portal property passwords.encryption.algorithm.legacy, whose default value is SHA. 
  • If the property passwords.encryption.algorithm.legacy is not informed, the current password algorithm will be used instead, producing the issue.
  • To ensure that old users using legacy encryption algorithms can login correctly and to avoid CPU and memory overuse, add the property passwords.encryption.algorithm.legacy to the file portal-ext.properties with the correct value (most likely, SHA).
  • Consider also defining a Password Policy that requires users to change their password regularly since changed passwords will be encrypted with the new algorithm. 
    • Note: this bug prevented the new algorithm from being used before 7.4 u54.

Additional Information

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?