ory/kratos · error · ErrHashParametersOutOfBounds
argon2 m= KiB not in [1, ]
Error message
argon2 m=%d KiB not in [1, %d]
What it means
This error means an Argon2id (or Argon2i) hash declares a memory parameter m that is 0 or greater than 1 GiB (1048576 KiB). Memory cost directly drives per-compare allocation, so unbounded m could OOM the process when an attacker submits hashes with huge m. It wraps ErrHashParametersOutOfBounds from validateArgon2Params during hash decode.
Solutions
- Check the m= field in the hash string; it must be 1..1048576 KiB
- Re-hash with a standard profile (Kratos default 128 MiB, OWASP recommends 64 MiB)
- For users with legitimate higher-memory hashes, rely on rehash-on-login rather than direct import
Example fix
// before (m=2 GiB, rejected) $argon2id$v=19$m=2097152,t=3,p=4$... // after (m=128 MiB, accepted) $argon2id$v=19$m=131072,t=3,p=4$...
Defensive patterns
Strategy: validation
Validate before calling
func argon2MemOK(mKiB uint64) bool { return mKiB >= 1 && mKiB <= 1<<20 }
// Or pre-validate the whole hash: hash.ValidateImportedHash(hashed) Try / catch
if err := hash.ValidateImportedHash(raw); errors.Is(err, hash.ErrHashParametersOutOfBounds) {
return fmt.Errorf("argon2 memory out of range: %w", err)
} Prevention
- Keep Argon2 memory at 64-128 MiB (OWASP / Kratos defaults)
- Reject user-supplied hash strings at intake via ValidateImportedHash
- Watch for multi-GiB memory settings when migrating from other platforms
When it happens
Trigger: decodeArgon2idHash parses an $argon2id$ (or $argon2i$) hash whose m= parameter is 0 or exceeds 1048576 KiB, via ValidateImportedHash or during password comparison.
Common situations: Importing hashes from systems configured with multi-GiB Argon2 memory (e.g. disk-encryption-grade settings); zeroed/corrupted hash parameters; migration from a security-tuned deployment with 2-4 GiB memory cost.
Understand the failure class
Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.
Related errors
- firescrypt ln= exceeds max
- scrypt N= not in [1, ]
- argon2 t= not in [1, ]
- argon2 p= not in [1, ]
- you must provide `secrets.pagination` for FIPS compliance
AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07).
Data as JSON: /api/errors/dc68eb5bdad442c1.
Report an issue: GitHub.
Appendix: source
Thrown at hash/hash_limits.go:107
return nil
}
func validateScryptParams(n, r, p uint32) error {
if n == 0 || n > maxScryptN {
return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt N=%d not in [1, %d]", n, maxScryptN)
}
if r == 0 || r > maxScryptR {
return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt r=%d not in [1, %d]", r, maxScryptR)
}
if p == 0 || p > maxScryptP {
return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt p=%d not in [1, %d]", p, maxScryptP)
}
return nil
}
func validateArgon2Params(memoryKiB uint64, iterations uint32, parallelism uint8) error {
if memoryKiB == 0 || memoryKiB > uint64(maxArgon2MemoryKiB) {
return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 m=%d KiB not in [1, %d]", memoryKiB, maxArgon2MemoryKiB)
}
if iterations == 0 || iterations > maxArgon2Iterations {
return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 t=%d not in [1, %d]", iterations, maxArgon2Iterations)
}
if parallelism == 0 || parallelism > maxArgon2Parallelism {
return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 p=%d not in [1, %d]", parallelism, maxArgon2Parallelism)
}
return nil
}
func validatePbkdf2Params(iterations uint32) error {
if iterations == 0 || iterations > maxPbkdf2Iterations {
return errors.Wrapf(ErrHashParametersOutOfBounds, "pbkdf2 i=%d not in [1, %d]", iterations, maxPbkdf2Iterations)
}
return nil
}
func validateBcryptHashCost(hashed []byte) error {View on GitHub (pinned to b86338da04)