diem/diem · error · CryptoMaterialError

{:?}

Error message

{:?}

What it means

This is the Display output of `CryptoMaterialError`, an enum in diem-crypto that models the two causes of key/signature validation failure: deserialization errors (mangled material, curve equation failures) and validation errors (material parses but is unsafe or unacceptable). Because the enum derives `#[error("{:?}", self)]`, the error message is just the Debug repr of the variant (e.g. `DeserializationError`), so you see the literal string `{:?}` in generic reporting contexts. It is thrown whenever key or signature material fails to load or validate.

Source

Thrown at crates/diem-crypto/src/traits.rs:25

//! [`bls12381`] modules.

use crate::hash::CryptoHash;
use anyhow::Result;
use core::convert::{From, TryFrom};
use rand::{rngs::StdRng, CryptoRng, RngCore, SeedableRng};
use serde::{de::DeserializeOwned, Serialize};
use std::{fmt::Debug, hash::Hash};
use thiserror::Error;

/// An error type for key and signature validation issues, see [`ValidCryptoMaterial`][ValidCryptoMaterial].
///
/// This enum reflects there are two interesting causes of validation
/// failure for the ingestion of key or signature material: deserialization errors
/// (often, due to mangled material or curve equation failure for ECC) and
/// validation errors (material recognizable but unacceptable for use,
/// e.g. unsafe).
#[derive(Clone, Debug, PartialEq, Eq, Error)]
#[error("{:?}", self)]
pub enum CryptoMaterialError {
    /// Struct to be signed does not serialize correctly.
    SerializationError,
    /// Key or signature material does not deserialize correctly.
    DeserializationError,
    /// Key or signature material deserializes, but is otherwise not valid.
    ValidationError,
    /// Key, threshold or signature material does not have the expected size.
    WrongLengthError,
    /// Part of the signature or key is not canonical resulting to malleability issues.
    CanonicalRepresentationError,
    /// A curve point (i.e., a public key) lies on a small group.
    SmallSubgroupError,
    /// A curve point (i.e., a public key) does not satisfy the curve equation.
    PointNotOnCurveError,
    /// BitVec errors in accountable multi-sig schemes.
    BitVecError(String),
}

View on GitHub (pinned to fc4714a8ea)

Solutions

1. Check the concrete variant in the Debug output: DeserializationError means the bytes are mangled; a validation variant means the material parses but is rejected.
2. Re-encode the key material in the exact format the API expects (hex vs base64, correct length) and retry.
3. Regenerate the key/secret if the source material is corrupted or from an incompatible scheme.

Example fix

// before
let key = Ed25519PrivateKey::from_encoded_string(key_hex.trim().trim_start_matches("0x"))?;
// after
let key = Ed25519PrivateKey::from_encoded_string(key_hex.trim())
    .map_err(|e| format!("invalid private key: {:?}", e))?;

fn valid_key_material(bytes: &[u8]) -> Result<(), String> {
    if bytes.len() != 32 {
        return Err(format!("expected 32 bytes, got {}", bytes.len()));
    }
    hex::decode(hex::encode(bytes)).map_err(|e| format!("not valid hex material: {}", e))?;
    Ok(())
}
// call before Ed25519PrivateKey::try_from(bytes)

fn is_crypto_material_error(e: &(dyn std::error::Error + 'static)) -> Option<&diem_crypto::CryptoMaterialError> {
    e.downcast_ref::<diem_crypto::CryptoMaterialError>()
}

match Ed25519PrivateKey::from_encoded_string(s) {
    Ok(k) => k,
    Err(e @ CryptoMaterialError::DeserializationError) => { log::warn!("mangled key material: {:?}", e); return Err(e.into()); }
    Err(e) => { log::error!("key validation rejected: {:?}", e); return Err(e.into()); }
}

When it happens

Trigger: Calling deserialization/validation APIs such as `Ed25519PrivateKey::from_encoded_string`, `try_from(&[u8])`, `from_bytes`, or `ValidCryptoMaterial::validating` checks with malformed, wrong-length, or curve-invalid bytes.

Common situations: Pasting hex/base64 keys with whitespace or wrong encoding, truncating key material when copying from config, loading keys generated by a different curve or library version, signature bytes corrupted in transit.

Related errors

• Missing field {0}
• Unable to parse key
• Failed to verify genesis
• Unable to deserialize address for account {0}: {1}
• Unable to decrypt address for account {0}: {1}

AI-assisted analysis of diem/diem@fc4714a8ea (2026-09-04). Data as JSON: /api/errors/40b517e6a134e02f. Report an issue: GitHub.