{"record":{"id":"d80897a88422c224","repo":"ory/kratos","slug":"argon2-t-d-not-in-1-d","errorCode":null,"errorMessage":"argon2 t=%d not in [1, %d]","messagePattern":"argon2 t=(.+?) not in \\[1, (.+?)\\]","errorType":"validation","errorClass":"ErrHashParametersOutOfBounds","httpStatus":null,"severity":"error","filePath":"hash/hash_limits.go","lineNumber":110,"sourceCode":"func validateScryptParams(n, r, p uint32) error {\n\tif n == 0 || n > maxScryptN {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt N=%d not in [1, %d]\", n, maxScryptN)\n\t}\n\tif r == 0 || r > maxScryptR {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt r=%d not in [1, %d]\", r, maxScryptR)\n\t}\n\tif p == 0 || p > maxScryptP {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt p=%d not in [1, %d]\", p, maxScryptP)\n\t}\n\treturn nil\n}\n\nfunc validateArgon2Params(memoryKiB uint64, iterations uint32, parallelism uint8) error {\n\tif memoryKiB == 0 || memoryKiB > uint64(maxArgon2MemoryKiB) {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 m=%d KiB not in [1, %d]\", memoryKiB, maxArgon2MemoryKiB)\n\t}\n\tif iterations == 0 || iterations > maxArgon2Iterations {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 t=%d not in [1, %d]\", iterations, maxArgon2Iterations)\n\t}\n\tif parallelism == 0 || parallelism > maxArgon2Parallelism {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 p=%d not in [1, %d]\", parallelism, maxArgon2Parallelism)\n\t}\n\treturn nil\n}\n\nfunc validatePbkdf2Params(iterations uint32) error {\n\tif iterations == 0 || iterations > maxPbkdf2Iterations {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"pbkdf2 i=%d not in [1, %d]\", iterations, maxPbkdf2Iterations)\n\t}\n\treturn nil\n}\n\nfunc validateBcryptHashCost(hashed []byte) error {\n\tcost, err := bcrypt.Cost(hashed)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/hash/hash_limits.go#L92-L128","documentation":"This error means an Argon2 hash declares an iterations (t/time-cost) parameter that is 0 or greater than 10. t=0 is invalid; large t linearly multiplies CPU cost per comparison, enabling CPU-exhaustion via crafted hashes. It wraps ErrHashParametersOutOfBounds from validateArgon2Params.","triggerScenarios":"decodeArgon2idHash encounters an $argon2id$ hash with t=0 or t>10 in its parameter list, on import (ValidateImportedHash) or at compare time.","commonSituations":"Hashes generated with extremely long time costs during security hardening; hand-edited hash strings; imports from tools whose presets exceed t=10 (the highest documented production value, Bitwarden's cap).","solutions":["Inspect the t= field; it must be within [1, 10]","Regenerate the hash with a recommended t (RFC 9106 suggests t=3; OWASP up to t=5)","Do not hand-edit; re-hash from the original password if t exceeds the cap"],"exampleFix":"// before (t=50, rejected)\n$argon2id$v=19$m=131072,t=50,p=4$...\n// after (t=3, accepted)\n$argon2id$v=19$m=131072,t=3,p=4$...","handlingStrategy":"validation","validationCode":"func argon2IterationsOK(t uint32) bool { return t >= 1 && t <= 10 }\n// Or pre-validate the whole hash: hash.ValidateImportedHash(hashed)","typeGuard":null,"tryCatchPattern":"if err := hash.ValidateImportedHash(raw); errors.Is(err, hash.ErrHashParametersOutOfBounds) {\n    return fmt.Errorf(\"argon2 t out of range: %w\", err)\n}","preventionTips":["Use RFC 9106 (t=3) or OWASP (t<=5) iteration counts","Avoid security-tuning tools that push t into double digits","Validate imported hashes with ValidateImportedHash before persistence"],"tags":["hashing","argon2"],"backgroundTag":"value-out-of-range","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}