pass_gen: work around AES decrypt bug in a different way