Allow multiple keypackets in session key decryption (#99)

* Fix session key decryption

* Break on all data packets

Co-authored-by: Daniel Huigens <d.huigens@protonmail.com>

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+### Changed
+- Session key decryption now considers multiple key packets 
+
+
 ## [2.1.0] 2020-11-04
 ### Security
 - Updated underlying crypto library

crypto/keyring_session.go

@@ -9,19 +9,29 @@ import (
 	"golang.org/x/crypto/openpgp/packet"
 )
 
-// DecryptSessionKey returns the decrypted session key from a binary encrypted session key packet.
+// DecryptSessionKey returns the decrypted session key from one or multiple binary encrypted session key packets.
 func (keyRing *KeyRing) DecryptSessionKey(keyPacket []byte) (*SessionKey, error) {
+	var p packet.Packet
+	var ek *packet.EncryptedKey
+
+	var err error
+	var hasPacket = false
+	var decryptErr error
+
 	keyReader := bytes.NewReader(keyPacket)
 	packets := packet.NewReader(keyReader)
 
-	var p packet.Packet
+Loop:
-	var err error
+	for {
 		if p, err = packets.Next(); err != nil {
-		return nil, errors.Wrap(err, "gopenpgp: error in reading packets")
+			break
 		}
 
-	ek := p.(*packet.EncryptedKey)
+		switch p := p.(type) {
-	var decryptErr error
+		case *packet.EncryptedKey:
+			hasPacket = true
+			ek = p
+
 			for _, key := range keyRing.entities.DecryptionKeys() {
 				priv := key.PrivateKey
 				if priv.Encrypted {
@@ -29,10 +39,25 @@ func (keyRing *KeyRing) DecryptSessionKey(keyPacket []byte) (*SessionKey, error)
 				}
 
 				if decryptErr = ek.Decrypt(priv, nil); decryptErr == nil {
-			break
+					break Loop
 				}
 			}
 
+		case *packet.SymmetricallyEncrypted,
+			*packet.AEADEncrypted,
+			*packet.Compressed,
+			*packet.LiteralData:
+			break Loop
+
+		default:
+			continue Loop
+		}
+	}
+
+	if !hasPacket {
+		return nil, errors.Wrap(err, "gopenpgp: couldn't find a session key packet that could be decrypted")
+	}
+
 	if decryptErr != nil {
 		return nil, errors.Wrap(decryptErr, "gopenpgp: error in decrypting")
 	}

crypto/sessionkey_test.go

@@ -51,7 +51,7 @@ func TestMultipleAsymmetricKeyPacket(t *testing.T) {
 	}
 
 	// Password defined in keyring_test
-	outputSymmetricKey, err := keyRingTestMultiple.DecryptSessionKey(keyPacket)
+	outputSymmetricKey, err := keyRingTestPrivate.DecryptSessionKey(keyPacket)
 	if err != nil {
 		t.Fatal("Expected no error while decrypting key packet, got:", err)
 	}