Throwing from `CipherBase::SetAAD` (static version) should be enough. `ERR_get_error()` will most likely not contain any useful information anyway.

I was thinking about moving the entire `ThrowCryptoTypeError` call to `CipherBase::SetAAD` (static version), but then the first `return false` might yield a wrong error message if OpenSSL's error queue is not empty.