Add thiserror for error handling and update dependencies

Author: stevefan1999-personal

Cargo.lock

@@ -27,22 +27,22 @@ chacha20 = { version = "0.10.0-rc.2", default-features = false, optional = true
 chacha20poly1305 = { version = "0.11.0-rc.1", default-features = false, optional = true }
 cipher = "0.5.0-rc.1"
 crypto-common = { version = "0.2.0-rc.4", default-features = false }
-der = { version = "0.8.0-rc.8", default-features = false, optional = true }
-digest = { version = "0.11.0-rc.1", default-features = false }
-ecdsa = { version = "0.17.0-rc.6", default-features = false, optional = true }
+der = { version = "0.8.0-rc.9", default-features = false, optional = true }
+digest = { version = "0.11.0-rc.3", default-features = false }
+ecdsa = { version = "0.17.0-rc.7", default-features = false, optional = true }
 ed25519-dalek = { version = "3.0.0-pre.1", default-features = false, optional = true }
-ed448-goldilocks = { version = "0.14.0-pre.3", default-features = false, optional = true }
-elliptic-curve = { version = "0.14.0-rc.13", default-features = false, optional = true }
-hmac = { version = "0.13.0-rc.1", default-features = false }
-p256 = { version = "0.14.0-pre.10", default-features = false, optional = true }
-p384 = { version = "0.14.0-pre.10", default-features = false, optional = true }
-p521 = { version = "0.14.0-pre.10", default-features = false, optional = true }
-pkcs1 = { version = "0.8.0-rc.3", default-features = false, optional = true }
-pkcs8 = { version = "0.11.0-rc.6", default-features = false, optional = true }
-rsa = { version = "0.10.0-rc.6", default-features = false, optional = true }
-sec1 = { version = "0.8.0-rc.9", default-features = false, optional = true }
+ed448-goldilocks = { version = "0.14.0-pre.4", default-features = false, optional = true }
+elliptic-curve = { version = "0.14.0-rc.15", default-features = false, optional = true }
+hmac = { version = "0.13.0-rc.2", default-features = false }
+p256 = { version = "0.14.0-pre.11", default-features = false, optional = true }
+p384 = { version = "0.14.0-pre.11", default-features = false, optional = true }
+p521 = { version = "0.14.0-pre.11", default-features = false, optional = true }
+pkcs1 = { version = "0.8.0-rc.4", default-features = false, optional = true }
+pkcs8 = { version = "0.11.0-rc.7", default-features = false, optional = true }
+rsa = { version = "0.10.0-rc.9", default-features = false, optional = true }
+sec1 = { version = "0.8.0-rc.10", default-features = false, optional = true }
 sha2 = { version = "0.11.0-rc.2", default-features = false }
-signature = { version = "3.0.0-rc.3", default-features = false, optional = true }
+signature = { version = "3.0.0-rc.4", default-features = false, optional = true }
 typenum = { version = "1.18.0", features = ["no_std", "const-generics"] }
 x25519-dalek = { version = "3.0.0-pre.1", default-features = false, optional = true }
 x448 = { version = "=0.14.0-pre.0", default-features = false, optional = true }
@@ -52,25 +52,26 @@ pki-types = { package = "rustls-pki-types", version = "1.12.0", default-features
 rand_core = { version = "0.9.3", default-features = false, features = [
     "os_rng",
 ], optional = true }
-rustls = { version = "0.23.31", default-features = false }
-webpki = { package = "rustls-webpki", version = "0.103.4", default-features = false, optional = true }
+rustls = { version = "0.23.32", default-features = false }
+webpki = { package = "rustls-webpki", version = "0.103.6", default-features = false, optional = true }
 enum_dispatch = "0.3.13"
 tinyvec = { version = "1.10.0", default-features = false, optional = true }
+thiserror = { version = "2.0.17", default-features = false }
 
 [dev-dependencies]
 bytes = { version = "1.10.1", default-features = false }
 itertools = { version = "0.14.0", default-features = false }
 rsa_098 = { package = "rsa", version = "0.9.8", features = ["sha2"] }
 signature_220 = { package = "signature", version = "2.2.0" }
-rustls = { version = "0.23.31", default-features = false, features = ["std"] }
+rustls = { version = "0.23.32", default-features = false, features = ["std"] }
 x509-cert = { version = "0.2.5", default-features = false, features = [
     "builder",
 ] }
 rand_core_064 = { package = "rand_core", version = "0.6.4" }
 p256_0132 = { package = "p256", version = "0.13.2" }
 
 [features]
-default = ["std", "tls12", "zeroize", "full", "fast"]
+default = ["std", "tls12", "zeroize", "full", "fast", "quic", "ticketer"]
 full = [
     "aead-full",
     "sign-full",
@@ -85,7 +86,7 @@ tls12 = ["rustls/tls12"]
 
 # RustCrypto is preparing to migrate to core::error::Error
 # and in before most of the use case for std is just std::error::Error
-std = ["alloc", "rustls/std", "ed448-goldilocks?/std", "tinyvec?/std"]
+std = ["alloc", "rustls/std", "ed448-goldilocks?/std", "tinyvec?/std", "thiserror/std"]
 alloc = [
     "ecdsa?/alloc",
     "ed448-goldilocks?/alloc",

Cargo.toml

@@ -1,5 +1,5 @@
 #[cfg(feature = "alloc")]
-use alloc::boxed::Box;
+use alloc::{boxed::Box, string::ToString};
 use core::fmt::Debug;
 use core::marker::PhantomData;
 
@@ -14,6 +14,26 @@ use rand_core::OsRng;
 use rustls::{Error, NamedGroup, PeerMisbehaved, crypto};
 use sec1::point::ModulusSize;
 
+/// Errors that can occur in NIST key exchange
+#[derive(Debug, thiserror::Error)]
+pub enum NistKxError {
+    /// Failed to generate private key
+    #[error("failed to generate private key: {0}")]
+    KeyGenerationFailed(rand_core::OsError),
+}
+
+impl From<rand_core::OsError> for NistKxError {
+    fn from(e: rand_core::OsError) -> Self {
+        Self::KeyGenerationFailed(e)
+    }
+}
+
+impl From<NistKxError> for rustls::Error {
+    fn from(e: NistKxError) -> Self {
+        rustls::Error::General(e.to_string())
+    }
+}
+
 pub trait NistCurve: Curve + CurveArithmetic + PointCompression {
     const NAMED_GROUP: NamedGroup;
 }
@@ -41,8 +61,7 @@ where
     }
 
     fn start(&self) -> Result<Box<dyn ActiveKeyExchange>, Error> {
-        let priv_key = EphemeralSecret::<C>::try_from_rng(&mut OsRng)
-            .map_err(|_| Error::General("Failed to generate private key".into()))?;
+        let priv_key = EphemeralSecret::<C>::try_from_rng(&mut OsRng).map_err(NistKxError::from)?;
 
         Ok(Box::new(NistKeyExchange::<C> {
             pub_key: priv_key.public_key().to_sec1_bytes(),
@@ -68,7 +87,7 @@ where
 {
     fn complete(self: Box<Self>, peer: &[u8]) -> Result<SharedSecret, Error> {
         let their_pub = PublicKey::<C>::from_sec1_bytes(peer)
-            .map_err(|_| Error::from(PeerMisbehaved::InvalidKeyShare))?;
+            .map_err(|_| rustls::PeerMisbehaved::InvalidKeyShare)?;
         Ok(self
             .priv_key
             .diffie_hellman(&their_pub)

src/kx/nist.rs

@@ -29,7 +29,7 @@ impl ActiveKeyExchange for X25519KeyExchange {
     fn complete(self: Box<X25519KeyExchange>, peer: &[u8]) -> Result<SharedSecret, rustls::Error> {
         let peer_array: [u8; 32] = peer
             .try_into()
-            .map_err(|_| rustls::Error::from(rustls::PeerMisbehaved::InvalidKeyShare))?;
+            .map_err(|_| rustls::PeerMisbehaved::InvalidKeyShare)?;
         Ok(self
             .priv_key
             .diffie_hellman(&peer_array.into())

src/kx/x25519.rs

@@ -76,8 +76,8 @@ impl KeyProvider for Provider {
     ) -> Result<Arc<dyn SigningKey>, rustls::Error> {
         feature_eval_expr!(
             [feature = "sign"],
-            sign::any_supported_type(&key_der),
-            else Err(rustls::Error::General("not key providers supported".into()))
+            sign::any_supported_type(&key_der).map_err(Into::into),
+            else Err(rustls::Error::General("no key providers supported".into()))
         )
     }
 }