rustfs/rustfs · error · EnrollmentError

SIGNATURE_MALFORMED

SIGNATURE_MALFORMED

Error message

the signature is not 64 octets of fixed-width r||s in unpadded base64url

What it means

EnrollmentError::SignatureMalformed fires when the document's signature is not exactly 64 octets of fixed-width r||s encoded as unpadded base64url — a strict structural check before any cryptographic verification.

Source

Thrown at rustfs/src/connect/offline/enrollment.rs:163

    pub issued_at: String,
    pub expires_at: String,
    pub connect_key_id: String,
    /// The signature value of the challenge, verbatim. It binds a response to
    /// the one challenge it answers, so it is carried rather than recomputed.
    pub challenge_proof: String,
}

/// Why an offline enrolment artifact was refused.
///
/// The variants are the frozen `reason` vocabulary of
/// `fixtures/offline-enrollment/error-codes.json`, which spans both halves of
/// the exchange. The device half implemented here produces the encoding, chain,
/// version, and freshness reasons; the reasons that describe a response being
/// evaluated against stored state — [`Self::ChallengeUnknown`],
/// [`Self::ChallengeProofInvalid`], [`Self::DeviceProofInvalid`],
/// [`Self::EnrollmentReplayed`], [`Self::OrganizationMismatch`], and
/// [`Self::ClusterMismatch`] — are Connect's to raise and are named here so the
/// two sides share one vocabulary.
///
/// No variant carries a payload: a rejection must never disclose key material,
/// signature octets, nonces, or document bytes.
#[derive(Debug, PartialEq, Eq, thiserror::Error)]
pub enum EnrollmentError {
    #[error("protocolVersion is missing, malformed, or names an unsupported major version")]
    UnsupportedProtocol,

    #[error("formatVersion is not a supported offline enrollment format")]
    UnsupportedFormat,

    #[error("the signature is not 64 octets of fixed-width r||s in unpadded base64url")]
    SignatureMalformed,

    #[error("the signature is not in its canonical low-S form")]
    SignatureNotCanonical,

    #[error("the signature does not verify over the received octets")]

View on GitHub (pinned to 5dca076efe)

Solutions

1. Regenerate the artifact; the signer may have emitted DER or padded base64
2. Ensure no transport layer re-encoded or truncated the signature
3. Confirm the signing tool produces raw r||s in unpadded base64url

When it happens

Trigger: Thrown at rustfs/src/connect/offline/enrollment.rs:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of rustfs/rustfs@5dca076efe (2026-08-23). Data as JSON: /api/errors/08d1d048dd91a493. Report an issue: GitHub.