Argon2Parameters Parallelism must be be greater than 0 and n

Error message

Argon2Parameters Parallelism must be be greater than 0 and no more than %d

What it means

Argon2 parallelism (number of lanes) must be between 1 and 255 (uint8), since it is narrowed to uint8 and supplied to argon2.IDKey. Values <= 0 or > MaxUint8 are rejected during parameter unmarshalling.

Source

Thrown at cert/crypto.go:237

		EncryptionMetadata: NebulaEncryptionMetadata{
			EncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,
			Argon2Parameters:    *params,
		},
		Ciphertext: rned.Ciphertext,
	}

	return &ned, nil
}

func unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {
	if params.Version < math.MinInt32 || params.Version > math.MaxInt32 {
		return nil, fmt.Errorf("Argon2Parameters Version must be at least %d and no more than %d", math.MinInt32, math.MaxInt32)
	}
	if params.Memory <= 0 || params.Memory > math.MaxUint32 {
		return nil, fmt.Errorf("Argon2Parameters Memory must be be greater than 0 and no more than %d KiB", uint32(math.MaxUint32))
	}
	if params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {
		return nil, fmt.Errorf("Argon2Parameters Parallelism must be be greater than 0 and no more than %d", math.MaxUint8)
	}
	if params.Iterations <= 0 || params.Iterations > math.MaxUint32 {
		return nil, fmt.Errorf("-argon-iterations must be be greater than 0 and no more than %d", uint32(math.MaxUint32))
	}

	return &Argon2Parameters{
		version:     params.Version,
		Memory:      params.Memory,
		Parallelism: uint8(params.Parallelism),
		Iterations:  params.Iterations,
		salt:        params.Salt,
	}, nil

}

// DecryptAndUnmarshalSigningPrivateKey will try to pem decode and decrypt an Ed25519/ECDSA private key with
// the given passphrase, returning any other bytes b or an error on failure
func DecryptAndUnmarshalSigningPrivateKey(passphrase, b []byte) (Curve, []byte, []byte, error) {

View on GitHub (pinned to dd8f660c0a)

Solutions

Set Parallelism to a positive value <= 255 (nebula default is 4) at the point the parameters are serialized
Re-encrypt with the library's EncryptAndMarshal* helpers to guarantee valid parameters
Reject untrusted blobs that fail this validation rather than trying to repair them

Example fix

// before
raw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2097152, Parallelism: 0}
// after
raw := &cert.RawNebulaArgon2Parameters{Version: 19, Memory: 2097152, Parallelism: 4, Iterations: 1, Salt: salt}

Defensive patterns

Strategy: validation

Validate before calling

if params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 { return fmt.Errorf("parallelism must be in [1, 255]") }

Try / catch

ned, err := cert.UnmarshalNebulaEncryptedData(b)
if err != nil {
    if strings.Contains(err.Error(), "Parallelism must be") { /* fix producing side or reject blob */ }
    return err
}

Prevention

Set Parallelism explicitly (nebula default: 4) when serializing
Clamp to uint8 range at the producer side
Never rely on proto3 zero defaults for required KDF parameters

When it happens

Trigger: Deserializing RawNebulaArgon2Parameters with Parallelism <= 0 (typically 0 from an unset proto3 field) or Parallelism > 255 in a blob passed to UnmarshalNebulaEncryptedData.

Common situations: External tooling omitting the Parallelism field; a corrupt/hostile blob; a generator writing parallelism as a wider-typed value without clamping.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/78187b806bdb215e. Report an issue: GitHub.