{"record":{"id":"0bc7589d67559c58","repo":"rustfs/rustfs","slug":"challenge-proof-invalid","errorCode":"CHALLENGE_PROOF_INVALID","errorMessage":"the response nonce or challengeProof is not the one issued for this challenge","messagePattern":"the response nonce or challengeProof is not the one issued for this challenge","errorType":"exception","errorClass":"EnrollmentError","httpStatus":null,"severity":"error","filePath":"rustfs/src/connect/offline/enrollment.rs","lineNumber":190,"sourceCode":"    #[error(\"formatVersion is not a supported offline enrollment format\")]\n    UnsupportedFormat,\n\n    #[error(\"the signature is not 64 octets of fixed-width r||s in unpadded base64url\")]\n    SignatureMalformed,\n\n    #[error(\"the signature is not in its canonical low-S form\")]\n    SignatureNotCanonical,\n\n    #[error(\"the signature does not verify over the received octets\")]\n    SignatureInvalid,\n\n    #[error(\"the trust chain is not issued by a root pinned in this build\")]\n    EnrollmentRootUnknown,\n\n    #[error(\"a trust link is invalid, misordered, or outside its validity at the challenge issuedAt\")]\n    TrustChainInvalid,\n\n    #[error(\"connectKeyId is not the subject of the last trust link\")]\n    ConnectKeyUnchained,\n\n    #[error(\"no issued challenge matches this challengeId\")]\n    ChallengeUnknown,\n\n    #[error(\"the challenge is not yet valid at the evaluation time\")]\n    ChallengeNotYetValid,\n\n    #[error(\"the challenge has expired at the evaluation time\")]\n    ChallengeExpired,\n\n    #[error(\"the response nonce or challengeProof is not the one issued for this challenge\")]\n    ChallengeProofInvalid,\n\n    #[error(\"the response does not prove possession of the device key it presents\")]\n    DeviceProofInvalid,\n\n    #[error(\"the challenge was already consumed\")]","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/rustfs/rustfs/blob/5dca076efed96e7b842de07c4c2111035ae7c7a2/rustfs/src/connect/offline/enrollment.rs#L172-L208","documentation":"The response's nonce or challengeProof does not equal the value issued with this challenge, so the proof is bound to a different (likely replayed or fabricated) exchange. Server-side reason during offline-enrollment verification.","triggerScenarios":"Thrown at rustfs/src/connect/offline/enrollment.rs:186 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the response from the exact challenge that was issued","Verify challenge/response pairing was not mixed across attempts","Restart the enrollment exchange from a new challenge"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5dca076efed96e7b842de07c4c2111035ae7c7a2","analyzedAt":"2026-08-23T16:57:04.676Z","contentChangedAt":"2026-08-23T16:57:04.676Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}