silentmode/theseus
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hermes: lift scrypt maxmem so Create account doesn't throw

Browse source 
N=2^15 r=8 p=1 needs 128 * N * r = ~32 MiB. Node's default maxmem for
scryptSync is exactly 32 MiB, so the derive call throws
MEMORY_LIMIT_EXCEEDED on the first create-account click. Pass maxmem:
128 MiB explicitly so the ceiling is above the KDF's working set with
headroom.

Applies to both wrap and unwrap paths; wrap params carry the KDF cost
inline so changing the N here would invalidate existing backups, but
unwrap already reads N from the blob — the maxmem lift is the only
needed change.
This commit is contained in:
Local Dev 2026-10-22 00:10:19 +03:00
parent 8171ea99d6
commit 4c10e3e724
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
main.js
View file

@ -10147,8 +10147,10 @@ const HERMES_SCRYPT = { N: 1 << 15, r: 8, p: 1, keyLen: 32 };
function hermesWrapMnemonic(mnemonic, password) {
const salt = nodeCrypto.randomBytes(16);
// N=2^15 r=8 p=1 needs ~32 MiB; Node's default maxmem is 32 MiB on-the-nose,
// which throws MEMORY_LIMIT_EXCEEDED. Lift the ceiling explicitly.
const key = nodeCrypto.scryptSync(String(password), salt, HERMES_SCRYPT.keyLen,
{ N: HERMES_SCRYPT.N, r: HERMES_SCRYPT.r, p: HERMES_SCRYPT.p });
{ N: HERMES_SCRYPT.N, r: HERMES_SCRYPT.r, p: HERMES_SCRYPT.p, maxmem: 128 * 1024 * 1024 });
const nonce = nodeCrypto.randomBytes(12);
const cipher = nodeCrypto.createCipheriv("aes-256-gcm", key, nonce);
const ct = Buffer.concat([cipher.update(String(mnemonic), "utf8"), cipher.final()]);
@ -10169,7 +10171,7 @@ function hermesUnwrapMnemonic(wrap, password) {
}
const salt = Buffer.from(wrap.kdf.salt, "hex");
const key = nodeCrypto.scryptSync(String(password), salt, HERMES_SCRYPT.keyLen,
{ N: wrap.kdf.N, r: wrap.kdf.r, p: wrap.kdf.p });
{ N: wrap.kdf.N, r: wrap.kdf.r, p: wrap.kdf.p, maxmem: 128 * 1024 * 1024 });
const nonce = Buffer.from(wrap.nonce, "hex");
const decipher = nodeCrypto.createDecipheriv("aes-256-gcm", key, nonce);
decipher.setAuthTag(Buffer.from(wrap.tag, "hex"));