pub enum IdentityError {
InvalidInputLength,
SerializationError,
RejectionSamplingFailed,
NormBoundViolation,
ChallengeMismatch,
InvalidAttributeCommitment,
ThresholdNotMet,
InvalidShareSet,
WireBadMagic,
WireBadVersion,
WireLengthMismatch,
CoefficientOutOfRange,
}Expand description
Closed set of failure reasons across all aethel:core WIT operations.
Variants§
InvalidInputLength
A byte-slice input was too short or malformed for the operation.
SerializationError
Serialization or deserialization of a proof/projection failed.
RejectionSamplingFailed
Rejection sampling exhausted its fixed iteration ceiling.
NormBoundViolation
A response vector’s infinity norm exceeded the rejection bound.
Reserved, no producer today. Reachable only through the superseded
saap verifier, which is crate-private and not exported by the
component. saap-verify-presentation reports a well-formed proof that
does not verify as ok(false), never as an error, because “this does
not verify” is a verdict and not a failure to reach one.
Kept for the predicate relation (RFC §5.6 relation 3), which is deliberately deferred and will need to distinguish a range proof whose response is out of bounds from one that simply does not hold.
ChallengeMismatch
A recomputed Fiat-Shamir challenge did not match the proof’s challenge.
Reserved, no producer today. Same reasoning as
Self::NormBoundViolation.
InvalidAttributeCommitment
A disclosed attribute did not match its vector commitment.
Reserved, no producer today. Same reasoning as
Self::NormBoundViolation.
ThresholdNotMet
Fewer than the threshold number of shares were supplied for reconstruction.
The supplied shares are not a valid, authenticated share set. Three causes, all folded into one variant because they share a consequence — none of them may reconstruct:
- an evaluation index appears more than once
- more shares were supplied than the scheme issues
- a share’s Merkle proof does not check out against the caller-supplied root (0X3-105)
Distinct from Self::SerializationError on purpose. “This share is
malformed” and “you sent the same share twice” (or “this share was
never part of the sharing it claims to be”) are different failures
with different fixes, and collapsing them is the same sentinel-flattening
this crate treats as a defect class elsewhere. Lagrange interpolation
over a repeated evaluation point is undefined, and interpolation over a
share nobody ever split is defined but meaningless; a share set
carrying either does not reconstruct to the shared secret, so it must
not reconstruct at all.
WireBadMagic
An aethel-plp-1 envelope’s magic bytes did not match
crate::EIAB_MAGIC.
WireBadVersion
An aethel-plp-1 envelope declared a version byte this build does not
recognize. See wire::WIRE_VERSION_PLP1.
WireLengthMismatch
An aethel-plp-1 envelope was too short to contain its header, or its
declared body length did not match the number of bytes actually
present after the header.
CoefficientOutOfRange
A decoded polynomial coefficient was >= Q, i.e. not a member of
R_q = Z_q[X]/(X^N + 1). Raised by crate::plp::EphemeralProjection::from_bytes
and crate::plp::ZkIdentityProof::from_bytes before any arithmetic
ever touches the value — add_mod/sub_mod assume reduced inputs, so
admitting an out-of-range coefficient would be a robustness defect
even though the Fiat-Shamir challenge recomputation means it is not,
by itself, a soundness break.