Enum ErrorKind 

#[non_exhaustive]
pub enum ErrorKind {
    InvalidLength,
    InvalidParameter,
    AuthenticationFailed,
    Unsupported,
    NotApprovedInFipsMode,
    SelfTestFailed,
    ModuleErrorState,
    EntropyFailure,
    CounterExhausted,
    MalformedEncoding,
    ProviderUnavailable,
    ProviderRefused,
    Internal,
}

Machine-actionable classification of a failure.

The discriminants are stable and are mirrored verbatim into the ontology (ic-ontology::error_catalog) so an agent can reason about recovery strategy without parsing English prose.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

InvalidLength

A buffer was too short or too long for the algorithm’s contract.

InvalidParameter

A key, nonce, or parameter was structurally unacceptable.

AuthenticationFailed

Authentication (MAC / AEAD tag / signature) failed to verify.

Unsupported

The requested algorithm exists but is not implemented in this build.

NotApprovedInFipsMode

The operation is not permitted while the module is in FIPS approved mode.

SelfTestFailed

A FIPS 140-3 self-test failed; the module has entered the error state.

ModuleErrorState

The module is in a hard error state and refuses all cryptographic service.

EntropyFailure

The entropy source failed or did not pass its health tests.

CounterExhausted

A counter (DRBG reseed, GCM invocation, sequence number) was exhausted.

MalformedEncoding

Input could not be decoded (hex, base64, DER, point encoding).

ProviderUnavailable

Whatever holds the key – a token, a TPM, a key service – could not be reached or could not answer, and the inputs were not at fault: a device error, a lost session, a network failure. The same call may succeed later.

Nothing in this library returns it. It is for implementations of Signer and the like over keys held elsewhere, which otherwise have no honest kind to report.

ProviderRefused

Whatever holds the key answered, and the answer was no: a PIN expired or locked out, a policy that forbids the operation, a credential without the permission. The inputs were not at fault and the same call will be refused again until someone changes that.

A provider that cannot tell this from ProviderUnavailable reports this one, so that nothing retries into a lockout.

Internal

An internal invariant was violated — always a library bug.

Implementations

impl ErrorKind

pub const ALL: &'static [ErrorKind]

Every kind, for callers that enumerate them.

This type is #[non_exhaustive], so no other crate can match on it exhaustively and none can tell whether it has seen them all. That is deliberate — it lets a variant be added without breaking callers — but it also means a list like the ontology’s error catalog cannot check its own completeness. This crate can, so the list is published from here and a test keeps it honest.

pub const fn id(self) -> &'static str

Stable kebab-case identifier used in ontology exports and CLI/MCP output.

pub const fn retryable(self) -> bool

Whether retrying the identical call could plausibly succeed.

Agents use this to decide between retry, re-parameterize, and abort.

pub const fn caller_correctable(self) -> bool

Whether the caller should change inputs and try again.

Trait Implementations

impl Clone for ErrorKind

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ErrorKind

impl Debug for ErrorKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ErrorKind

impl Hash for ErrorKind

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for ErrorKind

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for ErrorKind

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for ErrorKind

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for ErrorKind