Revert "fix(key): return RandomError instead of panicking when encapsulating"

The OS RNG failure case keeps panicking, consistent with generate_keypair.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: sduquette-devolutions

src/key/key_v2.rs

@@ -6,12 +6,12 @@ use super::Error;
 use super::Result;
 
 use hkdf::Hkdf;
-use rand::TryRng;
+use rand::rand_core::UnwrapErr;
 use rand::rngs::SysRng;
 use sha2::Sha256;
 use x_wing::{
-    DecapsulationKeyRejectNonContrib, Decapsulator, EncapsulationKey, KeyExport, KeyInit,
-    TryDecapsulate,
+    DecapsulationKeyRejectNonContrib, Decapsulator, Encapsulate, EncapsulationKey, KeyExport,
+    KeyInit, TryDecapsulate,
 };
 use zeroize::Zeroizing;
 
@@ -88,20 +88,16 @@ impl KeyV2Public {
     /// Encapsulates a fresh shared secret to this key and derives a 32-byte key from it with
     /// HKDF-SHA-256 (no salt) using `info` as the label.
     ///
-    /// Returns `Error::RandomError` if the OS random number generator is unavailable.
-    pub fn encapsulate(&self, info: &[u8]) -> Result<(Box<KemCiphertext>, Zeroizing<[u8; 32]>)> {
-        let mut randomness = Zeroizing::new([0u8; x_wing::ENCAPSULATION_RANDOMNESS_SIZE]);
-        SysRng
-            .try_fill_bytes(randomness.as_mut_slice())
-            .map_err(|_| Error::RandomError)?;
-
-        let (ciphertext, shared_secret) = self.key.encapsulate_deterministic((&*randomness).into());
+    /// # Panics
+    /// Panics if the OS random number generator is unavailable, like `generate_keypair`.
+    pub fn encapsulate(&self, info: &[u8]) -> (Box<KemCiphertext>, Zeroizing<[u8; 32]>) {
+        let (ciphertext, shared_secret) = self.key.encapsulate_with_rng(&mut UnwrapErr(SysRng));
         let shared_secret = Zeroizing::new(shared_secret);
 
-        Ok((
+        (
             Box::new(ciphertext),
             derive_key(shared_secret.as_slice(), info),
-        ))
+        )
     }
 }
 

src/key/mod.rs

@@ -359,7 +359,7 @@ impl PublicKey {
         info: &[u8],
     ) -> Result<(Box<KemCiphertext>, Zeroizing<[u8; 32]>)> {
         match &self.payload {
-            PublicKeyPayload::V2(x) => x.encapsulate(info),
+            PublicKeyPayload::V2(x) => Ok(x.encapsulate(info)),
             _ => Err(Error::InvalidDataType),
         }
     }

src/key_encapsulation/mod.rs

@@ -80,8 +80,9 @@ enum EncapsulatedKeyPayload {
 ///  * `version` - Version of the key encapsulation scheme to use. Use `KeyEncapsulationVersion::Latest` if you're not dealing with shared data.
 /// # Returns
 /// Returns the `EncapsulatedKey` to send to the recipient and the `SecretKey` it encapsulates.
-/// Returns `Error::InvalidDataType` if the public key is not a `KeyVersion::V2` key,
-/// or `Error::RandomError` if the OS random number generator is unavailable.
+/// Returns `Error::InvalidDataType` if the public key is not a `KeyVersion::V2` key.
+/// # Panics
+/// Panics if the OS random number generator is unavailable, like `generate_keypair`.
 /// # Example
 /// ```rust
 /// use devolutions_crypto::key::{generate_keypair, KeyVersion};