rustfs/rustfs · error · EnrollmentError

CHALLENGE_PROOF_INVALID

CHALLENGE_PROOF_INVALID

Error message

the response nonce or challengeProof is not the one issued for this challenge

What it means

The response's nonce or challengeProof does not equal the value issued with this challenge, so the proof is bound to a different (likely replayed or fabricated) exchange. Server-side reason during offline-enrollment verification.

Source

Thrown at rustfs/src/connect/offline/enrollment.rs:190

    #[error("formatVersion is not a supported offline enrollment format")]
    UnsupportedFormat,

    #[error("the signature is not 64 octets of fixed-width r||s in unpadded base64url")]
    SignatureMalformed,

    #[error("the signature is not in its canonical low-S form")]
    SignatureNotCanonical,

    #[error("the signature does not verify over the received octets")]
    SignatureInvalid,

    #[error("the trust chain is not issued by a root pinned in this build")]
    EnrollmentRootUnknown,

    #[error("a trust link is invalid, misordered, or outside its validity at the challenge issuedAt")]
    TrustChainInvalid,

    #[error("connectKeyId is not the subject of the last trust link")]
    ConnectKeyUnchained,

    #[error("no issued challenge matches this challengeId")]
    ChallengeUnknown,

    #[error("the challenge is not yet valid at the evaluation time")]
    ChallengeNotYetValid,

    #[error("the challenge has expired at the evaluation time")]
    ChallengeExpired,

    #[error("the response nonce or challengeProof is not the one issued for this challenge")]
    ChallengeProofInvalid,

    #[error("the response does not prove possession of the device key it presents")]
    DeviceProofInvalid,

    #[error("the challenge was already consumed")]

View on GitHub (pinned to 5dca076efe)

Solutions

  1. Regenerate the response from the exact challenge that was issued
  2. Verify challenge/response pairing was not mixed across attempts
  3. Restart the enrollment exchange from a new challenge
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at rustfs/src/connect/offline/enrollment.rs:186 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of rustfs/rustfs@5dca076efe (2026-08-23). Data as JSON: /api/errors/0bc7589d67559c58. Report an issue: GitHub.