{"record":{"id":"985f5f5ec7d66a14","repo":"ory/kratos","slug":"scrypt-r-d-not-in-1-d","errorCode":null,"errorMessage":"scrypt r=%d not in [1, %d]","messagePattern":"scrypt r=(.+?) not in \\[1, (.+?)\\]","errorType":"validation","errorClass":"ErrHashParametersOutOfBounds","httpStatus":null,"severity":"error","filePath":"hash/hash_limits.go","lineNumber":97,"sourceCode":"func validateFirebaseScryptParams(logN, r, p uint32) error {\n\tif logN > maxScryptLogN {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"firescrypt ln=%d exceeds max %d\", logN, maxScryptLogN)\n\t}\n\tif r == 0 || r > maxScryptR {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"firescrypt r=%d not in [1, %d]\", r, maxScryptR)\n\t}\n\tif p == 0 || p > maxScryptP {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"firescrypt p=%d not in [1, %d]\", p, maxScryptP)\n\t}\n\treturn nil\n}\n\nfunc validateScryptParams(n, r, p uint32) error {\n\tif n == 0 || n > maxScryptN {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt N=%d not in [1, %d]\", n, maxScryptN)\n\t}\n\tif r == 0 || r > maxScryptR {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt r=%d not in [1, %d]\", r, maxScryptR)\n\t}\n\tif p == 0 || p > maxScryptP {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt p=%d not in [1, %d]\", p, maxScryptP)\n\t}\n\treturn nil\n}\n\nfunc validateArgon2Params(memoryKiB uint64, iterations uint32, parallelism uint8) error {\n\tif memoryKiB == 0 || memoryKiB > uint64(maxArgon2MemoryKiB) {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 m=%d KiB not in [1, %d]\", memoryKiB, maxArgon2MemoryKiB)\n\t}\n\tif iterations == 0 || iterations > maxArgon2Iterations {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 t=%d not in [1, %d]\", iterations, maxArgon2Iterations)\n\t}\n\tif parallelism == 0 || parallelism > maxArgon2Parallelism {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 p=%d not in [1, %d]\", parallelism, maxArgon2Parallelism)\n\t}\n\treturn nil","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/hash/hash_limits.go#L79-L115","documentation":"This error means a plain scrypt hash declares an r (block size) parameter outside the valid range [1, 8]. r=0 makes the memory cost zero; r>8 exceeds the RFC 7914 block size and would push per-compare memory beyond the package's 128 MiB cap when combined with high N. It wraps ErrHashParametersOutOfBounds from validateScryptParams.","triggerScenarios":"decodeScryptHash parses a scrypt hash whose r parameter is 0 or greater than 8, on import (ValidateImportedHash) or during password comparison.","commonSituations":"Hashes produced by tools that allow r>8 (some file-encryption setups use r=16); corrupt or hand-modified hash strings; mixing parameter conventions between firebase-scrypt and plain scrypt exports.","solutions":["Check the r value in the hash string; it must be in [1, 8] (RFC 7914 and all OWASP configs use r=8)","Regenerate the hash with r=8 if it was produced by a non-standard tool","Never hand-edit hash parameters; re-hash from the original password when possible"],"exampleFix":"// before (r=16, rejected)\n$scrypt$N=131072$r=16$p=1$...\n// after (r=8, accepted)\n$scrypt$N=131072$r=8$p=1$...","handlingStrategy":"validation","validationCode":"func scryptROK(r uint32) bool { return r >= 1 && r <= 8 }\n// Or pre-validate the whole hash: hash.ValidateImportedHash(hashed)","typeGuard":null,"tryCatchPattern":"if err := hash.ValidateImportedHash(raw); errors.Is(err, hash.ErrHashParametersOutOfBounds) {\n    return fmt.Errorf(\"scrypt r out of range: %w\", err)\n}","preventionTips":["Fix r=8 in all password-hash generation configs (RFC 7914)","Add an import-time ValidateImportedHash call to catch bad r before storage","Never manually edit r in hash strings"],"tags":["hashing","scrypt"],"backgroundTag":"value-out-of-range","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}