ory/kratos · error · ErrHashParametersOutOfBounds

argon2 t= not in [1, ]

Error message

argon2 t=%d not in [1, %d]

What it means

This error means an Argon2 hash declares an iterations (t/time-cost) parameter that is 0 or greater than 10. t=0 is invalid; large t linearly multiplies CPU cost per comparison, enabling CPU-exhaustion via crafted hashes. It wraps ErrHashParametersOutOfBounds from validateArgon2Params.

Solutions

1. Inspect the t= field; it must be within [1, 10]
2. Regenerate the hash with a recommended t (RFC 9106 suggests t=3; OWASP up to t=5)
3. Do not hand-edit; re-hash from the original password if t exceeds the cap

Example fix

// before (t=50, rejected)
$argon2id$v=19$m=131072,t=50,p=4$...
// after (t=3, accepted)
$argon2id$v=19$m=131072,t=3,p=4$...

func argon2IterationsOK(t uint32) bool { return t >= 1 && t <= 10 }
// Or pre-validate the whole hash: hash.ValidateImportedHash(hashed)

if err := hash.ValidateImportedHash(raw); errors.Is(err, hash.ErrHashParametersOutOfBounds) {
    return fmt.Errorf("argon2 t out of range: %w", err)
}

When it happens

Trigger: decodeArgon2idHash encounters an $argon2id$ hash with t=0 or t>10 in its parameter list, on import (ValidateImportedHash) or at compare time.

Common situations: Hashes generated with extremely long time costs during security hardening; hand-edited hash strings; imports from tools whose presets exceed t=10 (the highest documented production value, Bitwarden's cap).

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• argon2 m= KiB not in [1, ]
• argon2 p= not in [1, ]
• firescrypt ln= exceeds max
• firescrypt r= not in [1, ]
• firescrypt p= not in [1, ]

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/d80897a88422c224. Report an issue: GitHub.

Appendix: source

Thrown at hash/hash_limits.go:110

func validateScryptParams(n, r, p uint32) error {
	if n == 0 || n > maxScryptN {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt N=%d not in [1, %d]", n, maxScryptN)
	}
	if r == 0 || r > maxScryptR {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt r=%d not in [1, %d]", r, maxScryptR)
	}
	if p == 0 || p > maxScryptP {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt p=%d not in [1, %d]", p, maxScryptP)
	}
	return nil
}

func validateArgon2Params(memoryKiB uint64, iterations uint32, parallelism uint8) error {
	if memoryKiB == 0 || memoryKiB > uint64(maxArgon2MemoryKiB) {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 m=%d KiB not in [1, %d]", memoryKiB, maxArgon2MemoryKiB)
	}
	if iterations == 0 || iterations > maxArgon2Iterations {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 t=%d not in [1, %d]", iterations, maxArgon2Iterations)
	}
	if parallelism == 0 || parallelism > maxArgon2Parallelism {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 p=%d not in [1, %d]", parallelism, maxArgon2Parallelism)
	}
	return nil
}

func validatePbkdf2Params(iterations uint32) error {
	if iterations == 0 || iterations > maxPbkdf2Iterations {
		return errors.Wrapf(ErrHashParametersOutOfBounds, "pbkdf2 i=%d not in [1, %d]", iterations, maxPbkdf2Iterations)
	}
	return nil
}

func validateBcryptHashCost(hashed []byte) error {
	cost, err := bcrypt.Cost(hashed)
	if err != nil {
		return err

View on GitHub (pinned to b86338da04)