gbp_sframe/error.rs
1/// Errors that can occur in the SFrame layer.
2#[derive(Debug, thiserror::Error)]
3pub enum SFrameError {
4 /// MLS `ExportSecret` failed.
5 #[error("MLS export failed: {0}")]
6 MlsExport(String),
7
8 /// AEAD encryption failed.
9 #[error("AEAD encryption failed")]
10 Encrypt,
11
12 /// AEAD decryption failed (wrong key, tampered ciphertext, bad AAD).
13 #[error("AEAD decryption failed")]
14 Decrypt,
15
16 /// SFrame header could not be parsed.
17 #[error("invalid SFrame header: {0}")]
18 Header(String),
19
20 /// The counter in the received frame has already been seen — replay.
21 #[error("replay detected: KID={kid} CTR={ctr}")]
22 Replay {
23 /// Key ID that carried the duplicate counter.
24 kid: u64,
25 /// The duplicated counter value.
26 ctr: u64,
27 },
28
29 /// This sender used up every counter value for its KID. Encrypting again
30 /// would have to reuse a `(key, KID, CTR)` nonce, so the encryptor refuses;
31 /// a new epoch (and hence a new base key) is required.
32 #[error("counter exhausted for KID {0:#x}: rotate the epoch")]
33 CounterExhausted(u64),
34
35 /// No key material is available for the KID carried in the frame.
36 #[error("unknown KID {0:#x}: epoch or sender not registered")]
37 UnknownKid(u64),
38}