{"record":{"id":"78187b806bdb215e","repo":"slackhq/nebula","slug":"argon2parameters-parallelism-must-be-be-greater-th","errorCode":null,"errorMessage":"Argon2Parameters Parallelism must be be greater than 0 and no more than %d","messagePattern":"Argon2Parameters Parallelism must be be greater than 0 and no more than (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/crypto.go","lineNumber":237,"sourceCode":"\t\tEncryptionMetadata: NebulaEncryptionMetadata{\n\t\t\tEncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,\n\t\t\tArgon2Parameters:    *params,\n\t\t},\n\t\tCiphertext: rned.Ciphertext,\n\t}\n\n\treturn &ned, nil\n}\n\nfunc unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {\n\tif params.Version < math.MinInt32 || params.Version > math.MaxInt32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Version must be at least %d and no more than %d\", math.MinInt32, math.MaxInt32)\n\t}\n\tif params.Memory <= 0 || params.Memory > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Memory must be be greater than 0 and no more than %d KiB\", uint32(math.MaxUint32))\n\t}\n\tif params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {\n\t\treturn nil, fmt.Errorf(\"Argon2Parameters Parallelism must be be greater than 0 and no more than %d\", math.MaxUint8)\n\t}\n\tif params.Iterations <= 0 || params.Iterations > math.MaxUint32 {\n\t\treturn nil, fmt.Errorf(\"-argon-iterations must be be greater than 0 and no more than %d\", uint32(math.MaxUint32))\n\t}\n\n\treturn &Argon2Parameters{\n\t\tversion:     params.Version,\n\t\tMemory:      params.Memory,\n\t\tParallelism: uint8(params.Parallelism),\n\t\tIterations:  params.Iterations,\n\t\tsalt:        params.Salt,\n\t}, nil\n\n}\n\n// DecryptAndUnmarshalSigningPrivateKey will try to pem decode and decrypt an Ed25519/ECDSA private key with\n// the given passphrase, returning any other bytes b or an error on failure\nfunc DecryptAndUnmarshalSigningPrivateKey(passphrase, b []byte) (Curve, []byte, []byte, error) {","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/crypto.go#L219-L255","documentation":"Argon2 parallelism (number of lanes) must be between 1 and 255 (uint8), since it is narrowed to uint8 and supplied to argon2.IDKey. Values <= 0 or > MaxUint8 are rejected during parameter unmarshalling.","triggerScenarios":"Deserializing RawNebulaArgon2Parameters with Parallelism <= 0 (typically 0 from an unset proto3 field) or Parallelism > 255 in a blob passed to UnmarshalNebulaEncryptedData.","commonSituations":"External tooling omitting the Parallelism field; a corrupt/hostile blob; a generator writing parallelism as a wider-typed value without clamping.","solutions":["Set Parallelism to a positive value <= 255 (nebula default is 4) at the point the parameters are serialized","Re-encrypt with the library's EncryptAndMarshal* helpers to guarantee valid parameters","Reject untrusted blobs that fail this validation rather than trying to repair them"],"exampleFix":"// before\nraw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2097152, Parallelism: 0}\n// after\nraw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2097152, Parallelism: 4, Iterations: 1, Salt: salt}","handlingStrategy":"validation","validationCode":"if params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 { return fmt.Errorf(\"parallelism must be in [1, 255]\") }","typeGuard":null,"tryCatchPattern":"ned, err := cert.UnmarshalNebulaEncryptedData(b)\nif err != nil {\n    if strings.Contains(err.Error(), \"Parallelism must be\") { /* fix producing side or reject blob */ }\n    return err\n}","preventionTips":["Set Parallelism explicitly (nebula default: 4) when serializing","Clamp to uint8 range at the producer side","Never rely on proto3 zero defaults for required KDF parameters"],"tags":["crypto","argon2","parallelism","bounds-check"],"backgroundTag":"invalid-crypto-parameter","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}