Argon2Parameters Version must be at least %d and no more tha

Error message

Argon2Parameters Version must be at least %d and no more than %d

What it means

unmarshalArgon2Parameters bounds the Argon2 version field to the int32 range before it is narrowed to the internal int representation. A version outside [-2147483648, 2147483647] is rejected because it cannot be a valid Argon2 version (real versions are small, e.g. 0x13).

Source

Thrown at cert/crypto.go:231

	params, err := unmarshalArgon2Parameters(rned.EncryptionMetadata.Argon2Parameters)
	if err != nil {
		return nil, err
	}

	ned := NebulaEncryptedData{
		EncryptionMetadata: NebulaEncryptionMetadata{
			EncryptionAlgorithm: rned.EncryptionMetadata.EncryptionAlgorithm,
			Argon2Parameters:    *params,
		},
		Ciphertext: rned.Ciphertext,
	}

	return &ned, nil
}

func unmarshalArgon2Parameters(params *RawNebulaArgon2Parameters) (*Argon2Parameters, error) {
	if params.Version < math.MinInt32 || params.Version > math.MaxInt32 {
		return nil, fmt.Errorf("Argon2Parameters Version must be at least %d and no more than %d", math.MinInt32, math.MaxInt32)
	}
	if params.Memory <= 0 || params.Memory > math.MaxUint32 {
		return nil, fmt.Errorf("Argon2Parameters Memory must be be greater than 0 and no more than %d KiB", uint32(math.MaxUint32))
	}
	if params.Parallelism <= 0 || params.Parallelism > math.MaxUint8 {
		return nil, fmt.Errorf("Argon2Parameters Parallelism must be be greater than 0 and no more than %d", math.MaxUint8)
	}
	if params.Iterations <= 0 || params.Iterations > math.MaxUint32 {
		return nil, fmt.Errorf("-argon-iterations must be be greater than 0 and no more than %d", uint32(math.MaxUint32))
	}

	return &Argon2Parameters{
		version:     params.Version,
		Memory:      params.Memory,
		Parallelism: uint8(params.Parallelism),
		Iterations:  params.Iterations,
		salt:        params.Salt,
	}, nil

View on GitHub (pinned to dd8f660c0a)

Solutions

Treat this as corrupt/hostile input: reject the blob; it cannot contain a valid Argon2 version
If this appears with data from your own tool, fix the serialization bug that wrote an out-of-range version
Re-encrypt the data with the library's own EncryptAndMarshal* helpers, which write argon2.Version

Defensive patterns

Strategy: try-catch

Validate before calling

if params.Version < math.MinInt32 || params.Version > math.MaxInt32 { return fmt.Errorf("version out of int32 range") }

Try / catch

ned, err := cert.UnmarshalNebulaEncryptedData(untrustedBlob)
if err != nil {
    if strings.Contains(err.Error(), "Argon2Parameters Version must be") { /* reject hostile/corrupt input */ }
    return err
}

Prevention

Never trust Argon2 parameters from untrusted sources; validate before use
Only write argon2.Version as the version field when serializing
Fuzz/validate any externally produced encrypted-data blobs

When it happens

Trigger: Deserializing a RawNebulaArgon2Parameters whose Version field (a 64-bit int) exceeds int32 bounds - only possible with maliciously or accidentally corrupted data, since legitimate Argon2 versions are tiny positive numbers.

Common situations: Processing untrusted/corrupted encrypted-data blobs; a bug in external tooling writing garbage version values; fuzz tests exploring hostile inputs.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/1ef4932cadef263e. Report an issue: GitHub.