Error codes
Both forms report failures with a code. The L4Re form uses numbers and the Windows form uses names; the two lists don't match one to one. This page lists every code with the situation in which the service currently sends it and the reaction that makes sense on the calling side.
L4Re form
The code is in the first 4 bytes of an error response's payload; see L4Re binary protocol.
| Value | Constant | When | What to do |
|---|---|---|---|
| 1 | WVDS_ERR_INVALID_HEADER | invalid header, length, level, or payload length field; HKDF output over 1024 bytes or empty IKM | fix the request |
| 2 | WVDS_ERR_INVALID_REQ_TYPE | unknown, reserved, or not-built-in request type | check the type and the service's build features |
| 3 | WVDS_ERR_INVALID_KEY_ID | non-zero key_id on WVDS_REQ_DERIVE_KEY | set key_id to 0 |
| 4 | WVDS_ERR_KEY_NOT_FOUND | WVDS_REQ_EXPORT_KEY for an unknown key ID or for a key without a public part | check the key ID; regenerate after a restart |
| 5 | WVDS_ERR_ENCRYPTION_FAILED | AES or ChaCha20 encryption failed, including unknown key ID or reused nonce; ML-KEM encapsulation failed | check the key ID and nonce |
| 6 | WVDS_ERR_DECRYPTION_FAILED | decryption failed, including a wrong tag or unknown key ID; ML-KEM decapsulation failed | treat the data as untrusted |
| 7 | WVDS_ERR_SIGNATURE_FAILED | signing failed, including unknown key ID | check the key ID |
| 8 | WVDS_ERR_VERIFICATION_FAILED | verification couldn't be performed, for example because the public key is unusable | treat the data as unverified |
| 9 | WVDS_ERR_INVALID_SIGNATURE | not sent at present; 0x11 reports an invalid signature as result 0 | – |
| 10 | WVDS_ERR_ALLOCATION_FAILED | no room for the response in shared memory | retry later |
| 65535 | WVDS_ERR_INTERNAL | key generation, derivation, or sending failed, including a full key store | check the service log |
The code is a 32-bit field; the values themselves fit in 16 bits.
Windows form
The name is in the response's error.code field; see Windows JSON protocol.
| Name | When |
|---|---|
INVALID_REQUEST | the line isn't valid JSON, operation is unknown, a required field is missing, or Base64 is invalid |
INVALID_KEY | the public key isn't readable as Base64 |
INVALID_NONCE | the aes_decrypt nonce isn't exactly 12 bytes |
INVALID_TAG | the aes_decrypt tag isn't exactly 16 bytes |
KEY_NOT_FOUND | unknown key ID in aes_encrypt and aes_decrypt; export_public_key for an unknown key ID or an AES key |
DECRYPTION_FAILED | the tag doesn't match; the data was altered or the key is wrong |
SIGNATURE_INVALID | verification couldn't be performed; an invalid signature is reported as valid: false without an error |
UNSUPPORTED_ALGORITHM | unknown algorithm or unknown level |
RATE_LIMIT_EXCEEDED | more than 60,000 requests in 60 seconds |
INTERNAL_ERROR | everything else, including unknown key ID in ml_dsa_sign and ml_kem_decapsulate, reused nonce, and a full key store |
The names NONCE_REUSED, TIMEOUT, and SUCCESS are defined but not sent at present.
Related topics
en/wiki/pqcrypt/svc/reference/error-codes.txt · Last modified: by Wolfgang van der Stille