Enum CipherError 

#[non_exhaustive]
pub enum CipherError {
    Authentication,
    Malformed {
        context: &'static str,
    },
    UnknownKeyId {
        key_id: u8,
    },
}

A failure raised by a PayloadCipher.

Like DurableError, a CipherError carries metadata only — never payload bytes, nonces, or key material (INV-5) — so it is always safe to log. The enum is #[non_exhaustive]: a concrete cipher may surface additional failure modes in future revisions.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Authentication

The AEAD tag did not verify: the entry was forged, relocated, or replayed under a different execution. Maps to DurableError::ReplayIntegrity.

Malformed

The stored blob is too short or otherwise structurally invalid before decryption.

Fields

context: &'static str

A non-sensitive description of the structural problem.

UnknownKeyId

The blob’s leading key-id selects no key registered with the cipher (e.g. a stale key was removed before its rotation window closed).

Fields

key_id: u8

The unrecognized key-id byte.

Trait Implementations

impl Debug for CipherError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for CipherError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for CipherError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<CipherError> for DurableError

fn from(err: CipherError) -> Self

Lift a cipher failure into the crate-wide error, preserving fail-closed semantics.

An authentication failure is a replay-integrity violation; a structural or key-selection failure is a decode failure. Both fail closed — no plaintext is ever returned.