ory/kratos · error · ErrHashParametersOutOfBounds
scrypt p= not in [1, ]
Error message
scrypt p=%d not in [1, %d]
What it means
This error means a plain scrypt hash declares a p (parallelization) parameter outside the valid range [1, 10]. p=0 does no work; high p multiplies CPU time linearly because Go's scrypt runs iterations serially, so a crafted hash could make every login attempt burn seconds of CPU. It wraps ErrHashParametersOutOfBounds from validateScryptParams.
Solutions
- Verify the p field is in [1, 10] and adjust or regenerate the hash
- Re-hash with an OWASP-recommended preset (N=2^17, r=8, p=1)
- Use rehash-on-login for users whose hashes legitimately exceed the ceiling
Example fix
// before (p=24, rejected) $scrypt$N=131072$r=8$p=24$... // after (p=1, accepted) $scrypt$N=131072$r=8$p=1$...
Defensive patterns
Strategy: validation
Validate before calling
func scryptPOK(p uint32) bool { return p >= 1 && p <= 10 }
// Or pre-validate the whole hash: hash.ValidateImportedHash(hashed) Try / catch
if err := hash.ValidateImportedHash(raw); errors.Is(err, hash.ErrHashParametersOutOfBounds) {
return fmt.Errorf("scrypt p out of range: %w", err)
} Prevention
- Keep p=1 (Go's scrypt gains nothing from p>1 since iterations run serially)
- Cap p at 10 in upstream hash-generation tooling before export
- Validate every imported hash with ValidateImportedHash
When it happens
Trigger: decodeScryptHash sees a scrypt hash with p=0 or p>10 (OWASP's highest documented config uses p=10), during import validation or password comparison.
Common situations: Migrating from systems tuned with high parallelization; forged hash imports via the admin API; copy-paste mistakes between KDF parameter sets.
Understand the failure class
Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.
Related errors
- firescrypt ln= exceeds max
- firescrypt r= not in [1, ]
- firescrypt p= not in [1, ]
- scrypt N= not in [1, ]
- scrypt r= not in [1, ]
AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07).
Data as JSON: /api/errors/f0068f98342e8067.
Report an issue: GitHub.
Appendix: source
Thrown at hash/hash_limits.go:100
}
if r == 0 || r > maxScryptR {
return errors.Wrapf(ErrHashParametersOutOfBounds, "firescrypt r=%d not in [1, %d]", r, maxScryptR)
}
if p == 0 || p > maxScryptP {
return errors.Wrapf(ErrHashParametersOutOfBounds, "firescrypt p=%d not in [1, %d]", p, maxScryptP)
}
return nil
}
func validateScryptParams(n, r, p uint32) error {
if n == 0 || n > maxScryptN {
return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt N=%d not in [1, %d]", n, maxScryptN)
}
if r == 0 || r > maxScryptR {
return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt r=%d not in [1, %d]", r, maxScryptR)
}
if p == 0 || p > maxScryptP {
return errors.Wrapf(ErrHashParametersOutOfBounds, "scrypt p=%d not in [1, %d]", p, maxScryptP)
}
return nil
}
func validateArgon2Params(memoryKiB uint64, iterations uint32, parallelism uint8) error {
if memoryKiB == 0 || memoryKiB > uint64(maxArgon2MemoryKiB) {
return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 m=%d KiB not in [1, %d]", memoryKiB, maxArgon2MemoryKiB)
}
if iterations == 0 || iterations > maxArgon2Iterations {
return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 t=%d not in [1, %d]", iterations, maxArgon2Iterations)
}
if parallelism == 0 || parallelism > maxArgon2Parallelism {
return errors.Wrapf(ErrHashParametersOutOfBounds, "argon2 p=%d not in [1, %d]", parallelism, maxArgon2Parallelism)
}
return nil
}
func validatePbkdf2Params(iterations uint32) error {View on GitHub (pinned to b86338da04)