private function getFirewallEncoder($firewallKey)
    {
        // get the encoder name
        $encoderName = $this->getFirewallConfig($firewallKey)->get('Encoder', 'Crypt');
        if (!$encoderName) {
            $encoderName = 'Plain';
        }

        // check if the encoder is defined in the global config
        $encoderConfig = $this->getConfig()->get('Encoders.' . $encoderName, false);

        // get the driver & params
        $driver = false;
        $params = null;
        if ($encoderConfig) {
            $driver = $encoderConfig->get('Driver', false);
            $params = $encoderConfig->get('Params', null, true);
        }

        // get the driver class name
        if (!$driver && isset(self::$encoders[$encoderName])) { // use built-in driver
            $driver = self::$encoders[$encoderName];
        } else {
            if (isset(self::$encoders[$driver])) { // driver defined as short-name built-in driver
                $driver = self::$encoders[$driver];
            } else {
                if (!$driver) {
                    throw new SecurityException('Invalid "Driver" param for "' . $encoderName . '" encoder.');
                }
            }
        }

        // create encoder instance
        return new Encoder($driver, $params);
    }