{"record":{"id":"dc68eb5bdad442c1","repo":"ory/kratos","slug":"argon2-m-d-kib-not-in-1-d","errorCode":null,"errorMessage":"argon2 m=%d KiB not in [1, %d]","messagePattern":"argon2 m=(.+?) KiB not in \\[1, (.+?)\\]","errorType":"validation","errorClass":"ErrHashParametersOutOfBounds","httpStatus":null,"severity":"error","filePath":"hash/hash_limits.go","lineNumber":107,"sourceCode":"\treturn nil\n}\n\nfunc validateScryptParams(n, r, p uint32) error {\n\tif n == 0 || n > maxScryptN {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt N=%d not in [1, %d]\", n, maxScryptN)\n\t}\n\tif r == 0 || r > maxScryptR {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt r=%d not in [1, %d]\", r, maxScryptR)\n\t}\n\tif p == 0 || p > maxScryptP {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"scrypt p=%d not in [1, %d]\", p, maxScryptP)\n\t}\n\treturn nil\n}\n\nfunc validateArgon2Params(memoryKiB uint64, iterations uint32, parallelism uint8) error {\n\tif memoryKiB == 0 || memoryKiB > uint64(maxArgon2MemoryKiB) {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 m=%d KiB not in [1, %d]\", memoryKiB, maxArgon2MemoryKiB)\n\t}\n\tif iterations == 0 || iterations > maxArgon2Iterations {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 t=%d not in [1, %d]\", iterations, maxArgon2Iterations)\n\t}\n\tif parallelism == 0 || parallelism > maxArgon2Parallelism {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"argon2 p=%d not in [1, %d]\", parallelism, maxArgon2Parallelism)\n\t}\n\treturn nil\n}\n\nfunc validatePbkdf2Params(iterations uint32) error {\n\tif iterations == 0 || iterations > maxPbkdf2Iterations {\n\t\treturn errors.Wrapf(ErrHashParametersOutOfBounds, \"pbkdf2 i=%d not in [1, %d]\", iterations, maxPbkdf2Iterations)\n\t}\n\treturn nil\n}\n\nfunc validateBcryptHashCost(hashed []byte) error {","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/hash/hash_limits.go#L89-L125","documentation":"This error means an Argon2id (or Argon2i) hash declares a memory parameter m that is 0 or greater than 1 GiB (1048576 KiB). Memory cost directly drives per-compare allocation, so unbounded m could OOM the process when an attacker submits hashes with huge m. It wraps ErrHashParametersOutOfBounds from validateArgon2Params during hash decode.","triggerScenarios":"decodeArgon2idHash parses an $argon2id$ (or $argon2i$) hash whose m= parameter is 0 or exceeds 1048576 KiB, via ValidateImportedHash or during password comparison.","commonSituations":"Importing hashes from systems configured with multi-GiB Argon2 memory (e.g. disk-encryption-grade settings); zeroed/corrupted hash parameters; migration from a security-tuned deployment with 2-4 GiB memory cost.","solutions":["Check the m= field in the hash string; it must be 1..1048576 KiB","Re-hash with a standard profile (Kratos default 128 MiB, OWASP recommends 64 MiB)","For users with legitimate higher-memory hashes, rely on rehash-on-login rather than direct import"],"exampleFix":"// before (m=2 GiB, rejected)\n$argon2id$v=19$m=2097152,t=3,p=4$...\n// after (m=128 MiB, accepted)\n$argon2id$v=19$m=131072,t=3,p=4$...","handlingStrategy":"validation","validationCode":"func argon2MemOK(mKiB uint64) bool { return mKiB >= 1 && mKiB <= 1<<20 }\n// Or pre-validate the whole hash: hash.ValidateImportedHash(hashed)","typeGuard":null,"tryCatchPattern":"if err := hash.ValidateImportedHash(raw); errors.Is(err, hash.ErrHashParametersOutOfBounds) {\n    return fmt.Errorf(\"argon2 memory out of range: %w\", err)\n}","preventionTips":["Keep Argon2 memory at 64-128 MiB (OWASP / Kratos defaults)","Reject user-supplied hash strings at intake via ValidateImportedHash","Watch for multi-GiB memory settings when migrating from other platforms"],"tags":["hashing","argon2","security"],"backgroundTag":"value-out-of-range","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}