x/crypto/openpgp: decryption fails when using cipher AES-192

[leonklingele]

Please see this script to reproduce the problem:
https://play.golang.org/p/vk58yYArMh

In line 17, set cipher := "aes128" / cipher := "aes256" and decryption will work fine.
However, when using cipher := "aes192", decryption will fail.

Decrypting the message via $ gpg --decrypt works fine for all three AES sizes, so the decryption routing of Go's openpgp package has an issue.

[odeke-em]

/cc @agl

[leonklingele]

Issue is caused by this check: https://github.com/golang/crypto/blob/9477e0b78b9ac3d0b03822fd95422e2fe07627cd/openpgp/packet/symmetric_key_encrypted.go#L91-L93
len(plaintextKey) returns 24 for CipherAES192 (and Cipher3DES as well) which is not a multiple of AES' block size (16).

[mdp]

As far as I can tell, the RFC doesn't have an answer here. Other libraries implementing this don't seem to check the keysize output of the Encrypted Session Key.

The Encrypted Session Key decrypts to a message with the following makeup:
[cipher algorithm octet][Session Key]

There are three things that can happen here:

1. the decrypted message specifies a cipher algo with a keysize larger than the SK
2. the decrypted message specifies a cipher algo with a keysize that is the same length as the SK
3. the decrypted message specifies a cipher algo with a keysize smaller than the SK

I think any case other than (2) should throw an error. But I'm not sure about the history on this one, maybe there was a reason for checking if it was a multiple of the blocksize.

[gopherbot]

CL https://golang.org/cl/35848 mentions this issue.

[mdp]

There's probably a good reason for allowing session key sizes that are a multiple of the blocksize vs just checking if it's the same length as cipher keysize. I've updated the CL to check Session Key size is either equal to cipher key size OR is a multiple of cipher block size.

Deferring to @agl, as he implemented this code originally and I'm sure has a better understanding of it.