To really verify the password, the function needs to verify
the encoding of decrypted DER block, but that can't be
done without knowing what the block represents.

As the function only returns the decrypted pem block,
without any interpretation, I don't think we can fix this issue.

I think it's possible to construct a PEM that can be decrypted
into two different but valid private keys with two different
passwords, although I don't have a proof.

IMHO, this is working as intended.

PS: your openssl example can detect the password is wrong
because it knows it's a RSA private key. Have you tried to
tell openssl it's a ECDSA private key and see if it can accept
the correct password or not?

Looking at the openssl output more carefully it does seem that they are just going through all the RSA private key parsers and trying to see if it matches any of them, before bailing.

It seems that to achieve what I want to do in Go I will have to do the PEM decoding and then try to parse it using the available formats:

func checkPassword(pem *pem.Block, password string) {
    key, err := x509.DecryptPEMBlock(pem, []byte(password))
    if err == nil {
        validKey := false
        _, err = x509.ParsePKCS8PrivateKey(key)
        if err == nil {
            validKey = true
        }

        _, err = x509.ParsePKCS1PrivateKey(key)
        if err == nil {
            validKey = true
        }

        if validKey == true {
            fmt.Println("Valid password found: " + password)
        }
    }
}

I'm ok with closing this as a "works as intended" with the caveat that this might be confusing for other people too. Maybe a source-code comment indicating this potential caveat would be appropriate? Not sure if it is a contrived example someone decoding an encrypted PEM but not actually trying to parse the private key.

The problem is that there might be private key encodings that Go
doesn't support (say, you invented a new public key scheme and
want to use PEM to store its private key), so even if DecryptPEMBlock
do what openssl does, it still can't be certain the password is wrong
even if none of the parser routine succeeded.

The docs is also correct, technically:
If an incorrect password is detected an IncorrectPasswordError is
returned.

The condition for returning IncorrectPasswordError is not "if password
is incorrect", instead it's "if incorrect password is detected".
that means there might be cases where an incorrect password can't
be detected.

I will propose a CL to add one sentence after that:
note that DecryptPEMBlock cannot detect all cases of incorrect password.

Perfect. Thank you @minux.

The change 7603 is not submitted yet, re-open.
PS: Gerrit+gopherbot will close this issue automatically when the change is submitted.

Note that this problem arises because of deficiencies in PEM encryption. Although PEM encryption may be needed to support reading existing keys, it shouldn't be used in anything new. Putting together scrypt[1] and secretbox[2] will be far stronger and won't have this problem.

[1] https://godoc.org/golang.org/x/crypto/scrypt
[2] https://godoc.org/golang.org/x/crypto/nacl/secretbox