pub enum Error {
NotOperational {
current: State,
},
SelfTestFailed {
test: &'static str,
},
ConditionalTestFailed {
reason: &'static str,
},
AlreadyInitialized,
InvalidInput,
AlgorithmRestricted {
service: Service,
},
NotImplemented,
}Expand description
Errors surfaced by the module boundary.
Every variant is constructed with a &'static str description so
that formatting is allocation-free; this lets the module report
failures even from no_std contexts and from within the self-test
runner itself.
Variants§
NotOperational
A service was invoked while the module was not in the
Operational state.
SelfTestFailed
A power-up self-test failed. The module is now in the Error
state.
ConditionalTestFailed
A conditional self-test (e.g. DRBG CRNGT, pairwise consistency)
failed during operation. The module is now in the Error state.
AlreadyInitialized
initialize was called while the module was already past
PowerOff. This is not itself a FIPS violation — it just means
a second caller raced with the first. The first call’s outcome
is authoritative; the race loser should read state to find
out.
InvalidInput
A cryptographic service was called with input bytes that do not encode a valid domain element (for example, a scalar that is zero or not less than the group order, or a point that is not a canonical encoding on the curve). This is distinct from a self-test failure: the module is still operational; the caller supplied out-of-range bytes. Algorithm primitives should return this rather than silently substituting a default.
AlgorithmRestricted
A service was invoked that is not permitted under the active
AlgorithmProfile. The module is still operational — the
algorithm exists but is restricted by policy. Switch to a
less restrictive profile (which requires a process restart)
or use an alternative algorithm that is permitted.
NotImplemented
A service was invoked for an algorithm that exists in the
Service enum but whose implementation has not yet been
completed. Stub crates return this. The algorithm is
recognized by the profile system and its gate will pass if
the profile permits it, but the actual cryptographic
operation is not yet available.