pub enum CryptoError {
KeyNotSet,
Keychain(String),
InvalidFormat,
InvalidNonce,
Base64(DecodeError),
InvalidStoredKey,
EncryptionFailed,
DecryptionFailed,
InvalidUtf8,
}Expand description
Errors returned by this crate.
Notes:
- Decryption failures are intentionally generic (see
CryptoError::DecryptionFailed) to avoid leaking details useful for oracle-style attacks. - Some errors are “format” errors (bad input string), others are environment errors (keychain), and others are cryptographic failures (auth/tag mismatch).
Variants§
KeyNotSet
The key does not exist in the OS keychain.
This is expected if you call decrypt / decrypt_bytes before any successful
call to encrypt / encrypt_bytes (or before init_keychain_key).
Keychain(String)
A keychain operation failed (read/write/permission/backing service failure).
InvalidFormat
The encrypted payload string was not in a recognized format.
Expected:
v1:nonce:ciphertext(current)nonce:ciphertext(legacy)
InvalidNonce
The decoded nonce length was not 12 bytes (AES-GCM standard).
Base64(DecodeError)
Base64 decoding failed.
InvalidStoredKey
The stored key existed but was not the correct size (must be 32 bytes after decoding).
This can happen if the keychain entry is corrupted or replaced.
EncryptionFailed
Encryption failed.
In practice this is rare and usually indicates an internal library failure.
DecryptionFailed
Decryption failed.
This occurs when:
- the wrong key is used,
- the ciphertext is corrupted,
- the authentication tag does not verify,
- the AAD does not match.
InvalidUtf8
Decrypted bytes were not valid UTF-8 when calling decrypt.