Avoid leaking crypto errors

Author: djc

Cargo.toml

@@ -71,7 +71,6 @@ rustdoc-args = ["--cfg", "docsrs"]
 
 [package.metadata.cargo_check_external_types]
 allowed_external_types = [
-    "aws_lc_rs::*",
     "bytes::*",
     "http::*",
     "http_body::*",

src/account.rs

@@ -537,7 +537,8 @@ impl Key {
     pub fn generate() -> Result<(Self, PrivateKeyDer<'static>), Error> {
         let rng = crypto::SystemRandom::new();
         let pkcs8 =
-            crypto::EcdsaKeyPair::generate_pkcs8(&crypto::ECDSA_P256_SHA256_FIXED_SIGNING, &rng)?;
+            crypto::EcdsaKeyPair::generate_pkcs8(&crypto::ECDSA_P256_SHA256_FIXED_SIGNING, &rng)
+                .map_err(|_| Error::Crypto)?;
         Ok((
             Self::new(pkcs8.as_ref(), rng)?,
             PrivatePkcs8KeyDer::from(pkcs8.as_ref().to_vec()).into(),
@@ -577,7 +578,10 @@ impl Signer for Key {
     }
 
     fn sign(&self, payload: &[u8]) -> Result<Self::Signature, Error> {
-        Ok(self.inner.sign(&self.rng, payload)?)
+        self
+            .inner
+            .sign(&self.rng, payload)
+            .map_err(|_| Error::Crypto)
     }
 }
 

src/lib.rs

@@ -321,26 +321,29 @@ mod crypto {
     pub(crate) use ring as ring_like;
 
     pub(crate) use ring_like::digest::{Digest, SHA256, digest};
-    pub(crate) use ring_like::error::{KeyRejected, Unspecified};
     pub(crate) use ring_like::hmac;
     pub(crate) use ring_like::rand::SystemRandom;
     pub(crate) use ring_like::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair};
     pub(crate) use ring_like::signature::{KeyPair, Signature};
 
+    use super::Error;
+
     #[cfg(feature = "aws-lc-rs")]
     pub(crate) fn p256_key_pair_from_pkcs8(
         pkcs8: &[u8],
         _: &SystemRandom,
-    ) -> Result<EcdsaKeyPair, KeyRejected> {
+    ) -> Result<EcdsaKeyPair, Error> {
         EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_FIXED_SIGNING, pkcs8)
+            .map_err(|_| Error::KeyRejected)
     }
 
     #[cfg(all(feature = "ring", not(feature = "aws-lc-rs")))]
     pub(crate) fn p256_key_pair_from_pkcs8(
         pkcs8: &[u8],
         rng: &SystemRandom,
-    ) -> Result<EcdsaKeyPair, KeyRejected> {
+    ) -> Result<EcdsaKeyPair, Error> {
         EcdsaKeyPair::from_pkcs8(&ECDSA_P256_SHA256_FIXED_SIGNING, pkcs8, rng)
+            .map_err(|_| Error::KeyRejected)
     }
 }
 

src/types.rs

@@ -31,11 +31,11 @@ pub enum Error {
     #[error(transparent)]
     Api(#[from] Problem),
     /// Failed from cryptographic operations
-    #[error("cryptographic operation failed: {0}")]
-    Crypto(#[from] crypto::Unspecified),
+    #[error("cryptographic operation failed")]
+    Crypto,
     /// Failed to instantiate a private key
-    #[error("invalid key bytes: {0}")]
-    CryptoKey(#[from] crypto::KeyRejected),
+    #[error("invalid key bytes")]
+    KeyRejected,
     /// HTTP failure
     #[error("HTTP request failure: {0}")]
     Http(#[from] http::Error),