From: Shenghou Ma <minux@golang.org>
Date: Sun, 15 Mar 2015 22:38:56 +0000 (-0400)
Subject: crypto/x509: document that DecryptPEMBlock cannot detect all cases of incorrect password
X-Git-Tag: go1.5beta1~1504
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=20b3a9b6eddfb7e3279a315a29f2b45f1ea603f6;p=gostls13.git

crypto/x509: document that DecryptPEMBlock cannot detect all cases of incorrect password

Fixes #10171.

Change-Id: I1b2e30ebbb2b9d66680008674baa96e550efe1f2
Reviewed-on: https://go-review.googlesource.com/7603
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
---

diff --git a/src/crypto/x509/pem_decrypt.go b/src/crypto/x509/pem_decrypt.go
index 194c81bf68..1d2c1c6ef6 100644
--- a/src/crypto/x509/pem_decrypt.go
+++ b/src/crypto/x509/pem_decrypt.go
@@ -108,7 +108,10 @@ var IncorrectPasswordError = errors.New("x509: decryption password incorrect")
 // encrypt it and returns a slice of decrypted DER encoded bytes. It inspects
 // the DEK-Info header to determine the algorithm used for decryption. If no
 // DEK-Info header is present, an error is returned. If an incorrect password
-// is detected an IncorrectPasswordError is returned.
+// is detected an IncorrectPasswordError is returned. Because of deficiencies
+// in the encrypted-PEM format, it's not always possible to detect an incorrect
+// password. In these cases no error will be returned but the decrypted DER
+// bytes will be random noise.
 func DecryptPEMBlock(b *pem.Block, password []byte) ([]byte, error) {
 	dek, ok := b.Headers["DEK-Info"]
 	if !ok {