{"record":{"id":"b9d936e36ccf8eb1","repo":"slackhq/nebula","slug":"encoded-argon2parameters-was-nil","errorCode":null,"errorMessage":"encoded Argon2Parameters was nil","messagePattern":"encoded Argon2Parameters was nil","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cert/crypto.go","lineNumber":210,"sourceCode":"\n// UnmarshalNebulaEncryptedData will unmarshal a protobuf byte representation of a nebula cert into its\n// protobuf-generated struct.\nfunc UnmarshalNebulaEncryptedData(b []byte) (*NebulaEncryptedData, error) {\n\tif len(b) == 0 {\n\t\treturn nil, fmt.Errorf(\"nil byte array\")\n\t}\n\tvar rned RawNebulaEncryptedData\n\terr := proto.Unmarshal(b, &rned)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif rned.EncryptionMetadata == nil {\n\t\treturn nil, fmt.Errorf(\"encoded EncryptionMetadata was nil\")\n\t}\n\n\tif rned.EncryptionMetadata.Argon2Parameters == nil {\n\t\treturn nil, fmt.Errorf(\"encoded Argon2Parameters was nil\")\n\t}\n\n\tparams, err := unmarshalArgon2Parameters(rned.EncryptionMetadata.Argon2Parameters)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tned := NebulaEncryptedData{\n\t\tEncryptionMetadata: NebulaEncryptionMetadata{\n\t\t\tEncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,\n\t\t\tArgon2Parameters:    *params,\n\t\t},\n\t\tCiphertext: rned.Ciphertext,\n\t}\n\n\treturn &ned, nil\n}\n","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/cert/crypto.go#L192-L228","documentation":"Within EncryptionMetadata, the Argon2Parameters sub-message must be present; it defines how the passphrase is stretched into the AES key. When the decoded message has EncryptionMetadata but a nil Argon2Parameters, the library cannot derive the key and fails with this error.","triggerScenarios":"Calling UnmarshalNebulaEncryptedData on data whose EncryptionMetadata was serialized without its Argon2Parameters field set (proto3 omits empty sub-messages), e.g. a partially populated NebulaEncryptedData built by hand or by an incomplete external implementation.","commonSituations":"Hand-assembling EncryptionMetadata with only the nonce; an external tool serializing a subset of fields; truncation of the message dropping the sub-message field.","solutions":["Populate Argon2Parameters (version, memory, parallelism, iterations, salt) in EncryptionMetadata before marshalling on the encrypting side","Re-encrypt using EncryptAndMarshalSigningPrivateKey / EncryptAndMarshalCert which always set Argon2Parameters","If the data came from another tool, confirm it writes the full nebula encrypted-data format"],"exampleFix":"// before\nmeta := &cert.EncryptionMetadata{Nonce: nonce}\n// after\nmeta := &cert.EncryptionMetadata{Nonce: nonce, Argon2Parameters: &cert.RawNebulaArgon2Parameters{Version: argon2.Version, Memory: 2*1024*1024, Parallelism: 4, Iterations: 1, Salt: salt}}","handlingStrategy":"type-guard","validationCode":"var rned cert.RawNebulaEncryptedData\nproto.Unmarshal(b, &rned)\nif rned.EncryptionMetadata != nil && rned.EncryptionMetadata.Argon2Parameters == nil { return fmt.Errorf(\"Argon2Parameters missing\") }","typeGuard":"func hasArgon2Params(b []byte) bool {\n    var r cert.RawNebulaEncryptedData\n    if proto.Unmarshal(b, &r) != nil { return false }\n    return r.EncryptionMetadata != nil && r.EncryptionMetadata.Argon2Parameters != nil\n}","tryCatchPattern":"ned, err := cert.UnmarshalNebulaEncryptedData(b)\nif err != nil {\n    if strings.Contains(err.Error(), \"Argon2Parameters was nil\") { /* incomplete metadata - re-encrypt */ }\n    return err\n}","preventionTips":["Populate Argon2Parameters whenever building EncryptionMetadata","Prefer library encrypt helpers over manual serialization","Round-trip test: marshal then unmarshal before storing artifacts"],"tags":["crypto","protobuf","argon2","missing-field"],"backgroundTag":"missing-required-argument","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}