openpgp: Don't include decrypted block in error message.

  - Even though the documentation warns that this function returns
    rich errors that must not be returned to the user, and the mid-level
    streaming decryption's API prevents leaking rich errors, including
    decrypted data in the error message seems dicey.

1 files changed, 1 insertions, 4 deletions

diff --git a/openpgp/src/parse.rs b/openpgp/src/parse.rs
index c8b329fd..d84ebba4 100644
--- a/openpgp/src/parse.rs
+++ b/openpgp/src/parse.rs
@@ -5272,10 +5272,7 @@ impl<'a> PacketParser<'a> {
                     if !(header[bl - 2] == header[bl]
                          && header[bl - 1] == header[bl + 1]) {
                         return Err(Error::InvalidSessionKey(
-                            format!(
-                                "Last two 16-bit quantities don't match: {}",
-                                crate::fmt::to_hex(&header[..], false)))
-                                   .into());
+                            "Decryption failed".into()).into());
                     }
                 }