Rejected requests

The service doesn't respond the way you expect. This page walks through the cases by symptom.

Possible causes:

• The caller sent more than 60,000 requests in 60 seconds. The service drops further requests without a response.
• The message was empty or longer than 16 bytes plus 64 KiB.
• The service isn't built as an L4Re task. A program built for a Linux target only runs a demonstration; see Deployment forms compared.
• The IPC names don't match. Your task must be named CRYPTO_CLI; the service is CRYPTO_SVC.

Fix: Give every request a timeout, limit the rate, and check the message size and names.

Check these in order: magic and version; payload_len equal to the message length minus 16; the level byte (2, 3, 5 for ML-DSA; 1, 3, 5 for ML-KEM); the length fields inside the payload. All numbers are little-endian. The test vectors show a valid message for each kind of request; see Verify the test vectors.

The request type is reserved (0x30, 0x31, 0x40, 0x41, 0x51), or the service was built without the required build feature (0x03 and 0x04 need chacha20).

• The key ID doesn't exist. The L4Re protocol can't create an AES key today; see Keys and key storage.
• The nonce was already used with this key. Generate a new one for every message.

The service restarted. It doesn't persist keys, so every key ID is invalid afterward. Generate new keys and distribute the new public keys.

• The message, public key, or level doesn't match the signature. Make sure you verify exactly the bytes that were signed, without the level byte and without an extra line break.
• The signature comes from the L4Re form before version 0.2.0. That version signed the level byte along with the message for 0x10; such signatures verify only over level || message.

More than 60,000 requests in 60 seconds across all pipes combined. The limit is fixed; rate_limit in the configuration doesn't change it.

The line isn't valid JSON, operation is unknown, a required field is missing, or a field isn't valid Base64. error.message points to the problem. Make sure each request is on a single line; the service doesn't understand JSON pretty-printed across several lines.

• Error codes