{"record":{"id":"2b2af60b4eb35d26","repo":"slackhq/nebula","slug":"argon-iterations-must-be-be-greater-than-0-and-no","errorCode":null,"errorMessage":"-argon-iterations must be be greater than 0 and no more than %d","messagePattern":"-argon-iterations must be be greater than 0 and no more than (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/crypto.go","lineNumber":240,"sourceCode":"\t\t},\n\t\tCiphertext: rned.Ciphertext,\n\t}\n\n\treturn &ned, nil\n}\n\nfunc unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {\n\tif params.Version < math.MinInt32 || params.Version > math.MaxInt32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Version must be at least %d and no more than %d\", math.MinInt32, math.MaxInt32)\n\t}\n\tif params.Memory <= 0 || params.Memory > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Memory must be be greater than 0 and no more than %d KiB\", uint32(math.MaxUint32))\n\t}\n\tif params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Parallelism must be be greater than 0 and no more than %d\", math.MaxUint8)\n\t}\n\tif params.Iterations <= 0 || params.Iterations > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"-argon-iterations must be be greater than 0 and no more than %d\", uint32(math.MaxUint32))\n\t}\n\n\treturn &Argon2Parameters{\n\t\tversion:     params.Version,\n\t\tMemory:      params.Memory,\n\t\tParallelism: uint8(params.Parallelism),\n\t\tIterations:  params.Iterations,\n\t\tsalt:        params.Salt,\n\t}, nil\n\n}\n\n// DecryptAndUnmarshalSigningPrivateKey will try to pem decode and decrypt an Ed25519/ECDSA private key with\n// the given passphrase, returning any other bytes b or an error on failure\nfunc DecryptAndUnmarshalSigningPrivateKey(passphrase, b []byte) (Curve, []byte, []byte, error) {\n\tvar curve Curve\n\n\tk, r := pem.Decode(b)","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/crypto.go#L222-L258","documentation":"Argon2 iteration count must be a positive value no greater than MaxUint32. Zero/negative or oversized iteration counts cannot be given to the Argon2 KDF, so the unmarshalling step rejects them. (Note the message text reuses the CLI flag name '-argon-iterations'.)","triggerScenarios":"Deserializing RawNebulaArgon2Parameters with Iterations <= 0 (usually 0 from an unset proto3 field) or Iterations > math.MaxUint32 in data passed to UnmarshalNebulaEncryptedData.","commonSituations":"Hand-built messages omitting Iterations; corrupted encrypted-data blobs from untrusted sources; tooling writing iteration counts in incompatible units causing overflow-scale values.","solutions":["Set Iterations to a positive value (nebula default is 1) wherever the parameters are serialized","Re-encrypt via EncryptAndMarshalSigningPrivateKey / EncryptAndMarshalCert so all Argon2 fields are populated correctly","Treat failing blobs from untrusted sources as invalid and refuse them"],"exampleFix":"// before\nraw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2097152, Parallelism: 4} // Iterations unset\n// after\nraw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2097152, Parallelism: 4, Iterations: 1, Salt: salt}","handlingStrategy":"validation","validationCode":"if params.Iterations <= 0 || params.Iterations > math.MaxUint32 { return fmt.Errorf(\"iterations must be in (0, %d]\", uint32(math.MaxUint32)) }","typeGuard":null,"tryCatchPattern":"ned, err := cert.UnmarshalNebulaEncryptedData(b)\nif err != nil {\n    if strings.Contains(err.Error(), \"argon-iterations must be\") { /* fix producing side or reject blob */ }\n    return err\n}","preventionTips":["Set Iterations explicitly (nebula default: 1) when serializing","Populate every Argon2 field - proto3 omits zero values, silently yielding 0","Use EncryptAndMarshal* helpers instead of manual serialization to avoid incomplete parameters"],"tags":["crypto","argon2","iterations","bounds-check"],"backgroundTag":"invalid-crypto-parameter","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}