remove unnecessarily defer

godoc says hash.Hash.Write never returns an error: https://pkg.go.dev/hash#Hash

> Write (via the embedded io.Writer interface) adds more data to the running hash.
> It never returns an error.

So, we don't need to check errors of Write and panics in Hmac.ComputeAuthTag.

jwe/internal/aescbc/aescbc.go

@@ -140,17 +140,20 @@ func (c Hmac) Overhead() int {
 }
 
 func (c Hmac) ComputeAuthTag(aad, nonce, ciphertext []byte) ([]byte, error) {
-	buf := make([]byte, len(aad)+len(nonce)+len(ciphertext)+8)
-	n := 0
-	n += copy(buf, aad)
-	n += copy(buf[n:], nonce)
-	n += copy(buf[n:], ciphertext)
-	binary.BigEndian.PutUint64(buf[n:], uint64(len(aad)*8))
+	var buf [8]byte
+	binary.BigEndian.PutUint64(buf[:], uint64(len(aad)*8))
 
 	h := hmac.New(c.hash, c.integrityKey)
-	if _, err := h.Write(buf); err != nil {
-		return nil, fmt.Errorf(`failed to write ComputeAuthTag using Hmac: %w`, err)
-	}
+
+	// compute the tag
+	// no need to check errors because Write never returns an error: https://pkg.go.dev/hash#Hash
+	//
+	// > Write (via the embedded io.Writer interface) adds more data to the running hash.
+	// > It never returns an error.
+	h.Write(aad)
+	h.Write(nonce)
+	h.Write(ciphertext)
+	h.Write(buf[:])
 	s := h.Sum(nil)
 	return s[:c.tagsize], nil
 }

jwe/internal/cipher/cipher.go

@@ -89,19 +89,6 @@ func (c AesContentCipher) Encrypt(cek, plaintext, aad []byte) (iv, ciphertxt, ta
 		return nil, nil, nil, fmt.Errorf(`failed to fetch AEAD: %w`, err)
 	}
 
-	// Seal may panic (argh!), so protect ourselves from that
-	defer func() {
-		if e := recover(); e != nil {
-			switch e := e.(type) {
-			case error:
-				err = e
-			default:
-				err = fmt.Errorf("%s", e)
-			}
-			err = fmt.Errorf(`failed to encrypt: %w`, err)
-		}
-	}()
-
 	var bs keygen.ByteSource
 	if c.NonceGenerator == nil {
 		bs, err = keygen.NewRandom(aead.NonceSize()).Generate()
@@ -133,20 +120,6 @@ func (c AesContentCipher) Decrypt(cek, iv, ciphertxt, tag, aad []byte) (plaintex
 		return nil, fmt.Errorf(`failed to fetch AEAD data: %w`, err)
 	}
 
-	// Open may panic (argh!), so protect ourselves from that
-	defer func() {
-		if e := recover(); e != nil {
-			switch e := e.(type) {
-			case error:
-				err = e
-			default:
-				err = fmt.Errorf(`%s`, e)
-			}
-			err = fmt.Errorf(`failed to decrypt: %w`, err)
-			return
-		}
-	}()
-
 	combined := make([]byte, len(ciphertxt)+len(tag))
 	copy(combined, ciphertxt)
 	copy(combined[len(ciphertxt):], tag)