Enum KeyCustodyError 

pub enum KeyCustodyError {
    MissingKek,
    BadKek(String),
    Encrypt,
    Decrypt,
}

Errors from key custody. No variant ever carries key material or plaintext.

Variants

MissingKek

No KEK is configured (FIRSTPASS_KEK / FIRSTPASS_KEK_FILE both unset).

BadKek(String)

A KEK was supplied but is unusable (wrong length, bad hex, unreadable file). The reason describes the shape of the failure only — never the key bytes.

Encrypt

Encryption failed (RNG or AEAD layer). Opaque by design.

Decrypt

Decryption/authentication failed — tamper, wrong KEK, wrong tenant, or truncated blob. Opaque by design: callers cannot tell which, so the type is not a decryption oracle.

Trait Implementations

impl Debug for KeyCustodyError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for KeyCustodyError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for KeyCustodyError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.