Argon2Parameters Memory must be be greater than 0 and no mor

Error message

Argon2Parameters Memory must be be greater than 0 and no more than %d KiB

What it means

The Argon2 memory cost must be a positive value no greater than MaxUint32 KiB. Zero, negative, or overflowing values cannot be passed to the Argon2 KDF, so unmarshalled parameters are validated before key derivation.

Source

Thrown at cert/crypto.go:234

	}

	ned := NebulaEncryptedData{
		EncryptionMetadata: NebulaEncryptionMetadata{
			EncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,
			Argon2Parameters:    *params,
		},
		Ciphertext: rned.Ciphertext,
	}

	return &ned, nil
}

func unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {
	if params.Version < math.MinInt32 || params.Version > math.MaxInt32 {
		return nil, fmt.Errorf("Argon2Parameters Version must be at least %d and no more than %d", math.MinInt32, math.MaxInt32)
	}
	if params.Memory <= 0 || params.Memory > math.MaxUint32 {
		return nil, fmt.Errorf("Argon2Parameters Memory must be be greater than 0 and no more than %d KiB", uint32(math.MaxUint32))
	}
	if params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {
		return nil, fmt.Errorf("Argon2Parameters Parallelism must be be greater than 0 and no more than %d", math.MaxUint8)
	}
	if params.Iterations <= 0 || params.Iterations > math.MaxUint32 {
		return nil, fmt.Errorf("-argon-iterations must be be greater than 0 and no more than %d", uint32(math.MaxUint32))
	}

	return &Argon2Parameters{
		version:     params.Version,
		Memory:      params.Memory,
		Parallelism: uint8(params.Parallelism),
		Iterations:  params.Iterations,
		salt:        params.Salt,
	}, nil

}

View on GitHub (pinned to dd8f660c0a)

Solutions

Set Memory to a sane positive KiB value (e.g. 2*1024*1024 for 2 GiB, matching nebula defaults) wherever the message is produced
If the field was simply omitted, re-encrypt with EncryptAndMarshalSigningPrivateKey so parameters are populated correctly
If the blob is from an untrusted source, reject it - memory parameters are part of authenticated encrypted data

Example fix

// before
raw := &cert.RawNebulaArgon2Parameters{Version: 19} // Memory unset = 0
// after
raw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2 * 1024 * 1024, Parallelism: 4, Iterations: 1, Salt: salt}

Defensive patterns

Strategy: validation

Validate before calling

if params.Memory <= 0 || params.Memory > math.MaxUint32 { return fmt.Errorf("memory must be in (0, %d] KiB", uint32(math.MaxUint32)) }

Try / catch

ned, err := cert.UnmarshalNebulaEncryptedData(b)
if err != nil {
    if strings.Contains(err.Error(), "Memory must be") { /* fix producing side or reject blob */ }
    return err
}

Prevention

Always set Memory explicitly (e.g. 2*1024*1024 KiB) when serializing parameters
Remember the unit is KiB, not bytes
Validate parameters at the producer side, before marshal

When it happens

Trigger: Deserializing RawNebulaArgon2Parameters with Memory <= 0 (proto3 default 0 when the field was unset) or Memory > math.MaxUint32, then calling UnmarshalNebulaEncryptedData.

Common situations: A hand-built or externally serialized message that omitted Memory (defaults to 0); corrupted data; a tool writing memory in bytes instead of KiB producing an overflow-sized value.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/6969b2e211d84863. Report an issue: GitHub.