crypto/x509: DecryptPEMBlock sometimes passes when the password is wrong

[azr]

Hello, my following test will fail all the time.
Running it once always passes though.

Context: Was trying to address hashicorp/packer#3337

What version of Go are you using (go version)?

go version go1.11 darwin/amd64

What operating system and processor architecture are you using (go env)?

go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/azr/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/azr/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/Cellar/go/1.11/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.11/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"

What did you do?

func TestEncodeDecode(t *testing.T) {
  data := []byte("data that I want to encrypt")
  pass := []byte("very secret password")
  for i := 0; i < 1000; i++ {
    // Encrypt the file
    b, err := x509.EncryptPEMBlock(rand.Reader,
      "RSA PRIVATE KEY",
      data,
      pass,
      x509.PEMCipherAES256)
    if err != nil {
      t.Fatalf("err: %s", err)
    }
    bf := &bytes.Buffer{}

    err = pem.Encode(bf, b)
    if err != nil {
      t.Fatalf("err: %s", err)
    }
    privateKey := bf.Bytes()

    PEMBlock, _ := pem.Decode(privateKey)
    if PEMBlock == nil {
      t.Fatal("")
    }

    if x509.IsEncryptedPEMBlock(PEMBlock) {
      decryptedPrivateKeyBytes, err := x509.DecryptPEMBlock(PEMBlock, []byte("wrooooong"))
      if err == nil {
        if string(decryptedPrivateKeyBytes) != string(data) {
          t.Fatalf("this is not supposed to happen: %s", decryptedPrivateKeyBytes)
        }
      }
    }
  }
}

What did you expect to see?

PASS

What did you see instead?

--- FAIL: TestEncodeDecode (0.00s)
    private_key_test.go:149: this is not supposed to happen:   {n<r   WVzQ p(!0D  )^fv
FAIL
FAIL    github.com/hashicorp/packer/builder/googlecompute       0.079s

[andybons]

@FiloSottile

[minaevmike]

from docs to DecryptPEMBlock

// If an incorrect password
// is detected an IncorrectPasswordError is returned. Because of deficiencies
// in the encrypted-PEM format, it's not always possible to detect an incorrect
// password. In these cases no error will be returned but the decrypted DER
// bytes will be random noise.

seems this is documented behavior

[azr]

Oh, I also totally missed that part, then I'm closing this issue.