{"record":{"id":"6969b2e211d84863","repo":"slackhq/nebula","slug":"argon2parameters-memory-must-be-be-greater-than-0","errorCode":null,"errorMessage":"Argon2Parameters Memory must be be greater than 0 and no more than %d KiB","messagePattern":"Argon2Parameters Memory must be be greater than 0 and no more than (.+?) KiB","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/crypto.go","lineNumber":234,"sourceCode":"\t}\n\n\tned := NebulaEncryptedData{\n\t\tEncryptionMetadata: NebulaEncryptionMetadata{\n\t\t\tEncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,\n\t\t\tArgon2Parameters:    *params,\n\t\t},\n\t\tCiphertext: rned.Ciphertext,\n\t}\n\n\treturn &ned, nil\n}\n\nfunc unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {\n\tif params.Version < math.MinInt32 || params.Version > math.MaxInt32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Version must be at least %d and no more than %d\", math.MinInt32, math.MaxInt32)\n\t}\n\tif params.Memory <= 0 || params.Memory > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Memory must be be greater than 0 and no more than %d KiB\", uint32(math.MaxUint32))\n\t}\n\tif params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Parallelism must be be greater than 0 and no more than %d\", math.MaxUint8)\n\t}\n\tif params.Iterations <= 0 || params.Iterations > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"-argon-iterations must be be greater than 0 and no more than %d\", uint32(math.MaxUint32))\n\t}\n\n\treturn &Argon2Parameters{\n\t\tversion:     params.Version,\n\t\tMemory:      params.Memory,\n\t\tParallelism: uint8(params.Parallelism),\n\t\tIterations:  params.Iterations,\n\t\tsalt:        params.Salt,\n\t}, nil\n\n}\n","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/crypto.go#L216-L252","documentation":"The Argon2 memory cost must be a positive value no greater than MaxUint32 KiB. Zero, negative, or overflowing values cannot be passed to the Argon2 KDF, so unmarshalled parameters are validated before key derivation.","triggerScenarios":"Deserializing RawNebulaArgon2Parameters with Memory <= 0 (proto3 default 0 when the field was unset) or Memory > math.MaxUint32, then calling UnmarshalNebulaEncryptedData.","commonSituations":"A hand-built or externally serialized message that omitted Memory (defaults to 0); corrupted data; a tool writing memory in bytes instead of KiB producing an overflow-sized value.","solutions":["Set Memory to a sane positive KiB value (e.g. 2*1024*1024 for 2 GiB, matching nebula defaults) wherever the message is produced","If the field was simply omitted, re-encrypt with EncryptAndMarshalSigningPrivateKey so parameters are populated correctly","If the blob is from an untrusted source, reject it - memory parameters are part of authenticated encrypted data"],"exampleFix":"// before\nraw := &cert.RawNebulaArgon2Parameters{Version: 19} // Memory unset = 0\n// after\nraw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2 * 1024 * 1024, Parallelism: 4, Iterations: 1, Salt: salt}","handlingStrategy":"validation","validationCode":"if params.Memory <= 0 || params.Memory > math.MaxUint32 { return fmt.Errorf(\"memory must be in (0, %d] KiB\", uint32(math.MaxUint32)) }","typeGuard":null,"tryCatchPattern":"ned, err := cert.UnmarshalNebulaEncryptedData(b)\nif err != nil {\n    if strings.Contains(err.Error(), \"Memory must be\") { /* fix producing side or reject blob */ }\n    return err\n}","preventionTips":["Always set Memory explicitly (e.g. 2*1024*1024 KiB) when serializing parameters","Remember the unit is KiB, not bytes","Validate parameters at the producer side, before marshal"],"tags":["crypto","argon2","memory","bounds-check"],"backgroundTag":"invalid-crypto-parameter","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}