Android keystore stopped working

Question

Just recently I have had a problem with a key store. I know there are plenty of questions about this problem already. I have read them all and Googled furiously.

Error:

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect
java.io.IOException: Keystore was tampered with, or password was incorrect
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:772)
    at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
    at java.security.KeyStore.load(KeyStore.java:1214)
    at sun.security.tools.KeyTool.doCommands(KeyTool.java:885)
    at sun.security.tools.KeyTool.run(KeyTool.java:340)
    at sun.security.tools.KeyTool.main(KeyTool.java:333)
Caused by: java.security.UnrecoverableKeyException: Password verification failed
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:770)
    ... 5 more

Software I am using:

Java

java version "1.7.0_21"
Java(TM) SE Runtime Environment (build 1.7.0_21-b11)
Java HotSpot(TM) 64-Bit Server VM (build 23.21-b01, mixed mode)

Eclipse

Version: 3.8.0
Build id: I20120502-2000

Latest ADT Plugin

Latest Android SDK

Here is what I know:

• I did not lose the password and it has never changed.
• I cannot retrieve the password(I know the pass).
• I cannot sign an existing application with a different key without releasing a brand new application(So I cannot publish any updates).

Here is what I have done:

• I have uninstalled and re-installed Eclipse many times.
• I have uninstalled and re-installed the android ADT plugin.
• I have removed and re-downloaded lastest Android SDK many times.
• I have uninstalled and re-installed JDK7.
• I have tried using the backups of my keystore.
• I have checked the MD5 checksums using "md5sum KEYSTORE" and compared with the backups(same MD5 output - not tampered).
• I have tried brute-forcing the key store(I have retrieved the password that I knew).
• I created a test key(with current setup) and tested the password and it seems to worked fine(so something has changed).
• I have tried exporting the android .apk manually and then tried to sign it(Outside of Eclipse).

Here is how I export a signed application:

• Through Eclipse: Exporting of using File > Export > Export Android Application.
• Before JDK7: jarsigner -verbose -keystore KEYSTORE FILE ALIAS.
• With JDK7: jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore KEYSTORE FILE ALIAS.

What is there left to figure out or try?

• Some of the references/URLs say to remove the "trusted.certs" file?
• Try deleting the "debug.keystore"?
• Would updating Eclipse or any of the Android development tools affect my keystore?
• Would updating Java from jdk6 to jdk7 create any problems?
• Could this have messed with or change how the jarsigner works in anyway?

User suggestions:

• Try using JDK6, but I was able to recently export an application.
• Checked key.store.password or key.alias.password in my local.properties
• Unchecking the build automatically in eclipse and clean your project
• Try to remove .metadata folder in your workspace and clear all temp folders.

Summary

• Keystores did not change,
• I have the passwords to the keystores,
• I have successfully exported an application recently using:
  • Eclipse 3.8 (and Eclipse 4.0+),
  • Latest Java 7,
  • Latest ADT Plugin.
• My last successful export and build was a few weeks ago using Eclipse 3.8, latest Android tools and Java 7 with the same password.

Update (6/29/14)

• I have used: keytool -list -keystore KEYSTORE to successfully prove and show that 3 out of my 4 keys work.
• I bruteforced the last key and obtained the password from the keystore(The pass I already knew), but the password does not work when I enter for signing. I have used: java -jar AndroidKeystoreBrute_v1.02.jar -m 3 -k KEYSTORE -d WORDLIST.
• Strangely enough, sometimes when I type my password into eclipse very quickly, my alias will show up and I can successfully export my application. (I know this is crazy).
• Updated Java version.

If I type in the password very quickly it works, sometimes.

It seems that opening up Eclipse and entering the password the first time lets me use the keystore.

Obviously, if all else fails, I will have to create a new key store. I really would like to get this resolved, I am just not sure what to do now besides republish with a new key.

If the key cannot be recovered properly, I might open source it on Github.

---

Solution (6/29/14):

A special thanks to user Erhannis!

Here is what I did:

The command would error out on me each time:

keytool -importkeystore -srckeystore old.keystore -destkeystore new.keystore -v

Since you told me we could extract private keys from the Java Keystore(.jks), I dug deeper and ended up using a variation of the command. I followed the links you posted here and here:

keytool -importkeystore -srckeystore old.keystore -destkeystore new.keystore -deststoretype pkcs12

After extracting the private key and storing as PKCS12, I think extracted my private key and put it back into a brand new Java Keystore:

keytool -importkeystore -srckeystore new.keystore -srcstoretype pkcs12 -destkeystore final.keystore -deststoretype jks

---

References:

http://developer.android.com/tools/publishing/app-signing.html#signapp

http://code.google.com/p/android-keystore-password-recover/

List of StackOverflow URLs I have read:

How to handle a lost KeyStore password in Android?

Invalid Keystore problem?

Android: I lost my android key store, what should I do?

I lost my .keystore file?

Forgot Keystore password, thinking of Brute-Force detection. will it corrupt the keystore?

I have lost the password for android Keystore file

Problem running my signed, release keystore in Eclipse

Android - Forgot keystore password. Can I decrypt keystore file?

Android release keystore issue: "Keystore was tampered with, or password was incorrect"

Iceboat

Is it possible that your keystore file could have been corrupted in some way? Does it work if you try using a backup keystore file, that has been stored somewhere else (if you have one)? – Arboreous

I have answered this. I have checked the MD5s on the backups as well as the current to see if they are the same. I also have tried using the backups to no avail. – Iceboat

I stored it locally but I always keep backups. – Iceboat

I think I may have the same issue. Do you think it could be this problem? – Puzzlement

It seems very similar. Everything started happening when I updated a while ago. It only affected one application. – Iceboat

I got this error: Enter key password for <harmankaya> keytool error: java.security.UnrecoverableKeyException: Cannot recover key – Testosterone

Answer 1

I may have had the same problem. I never did figure out why it was failing (though I wonder if it was because the keystore password was shorter than 6 digits), but I was able to copy my key into a new keystore, which I then renamed to replace the old one, and it mysteriously worked after that (using the new passwords). Needed the key password, by the way. Working off https://security.stackexchange.com/a/3795, I did the following:

1. keytool -importkeystore -srckeystore old.keystore -destkeystore new.keystore -v
2. Entered the new keystore password twice
3. Hit Enter when it asked me for the source keystore password (left it blank)
4. Entered the key password

After double-checking that the new one worked, I just copied it over the old one. Hope it works for you; good luck.

Puzzlement

I'm a bit confused as to why it tagged my post as "community wiki." Edit: Oh, wait, I get it. The question itself is marked as "community wiki." – Puzzlement

for some reason, I am just now seeing this, I will try it soon and get back to you! – Iceboat

Sorry for the long wait. I have tried this but I always receive the same error each time I try typing it the password. – Iceboat

@JaredBurrows Did it give you the error when you tried to copy the key into the new keystore, or when you tried to use the new keystore? – Puzzlement

Yes, It always complains about the password. However, when I use the bruteforce tool, I retrieve the password. The tool is able to login/check for the correct password. – Iceboat

@JaredBurrows Er, sorry; WHAT complains about the password? keytool -importkeystore, or when you try to use the copied keystore? Also, when you say "The tool is able to login/check for the correct password", do you mean that your problem is solved, or just that the brute force tool confirms that you have the correct password, even though keytool says it isn't? – Puzzlement

I have tried this again recently. It complains that when I leave the password blank, "Keystore password is too short - must be at least 6 characters". The brute force tool confirms my password. – Iceboat

I get java.security.UnrecoverableKeyException: Cannot recover key – Endopeptidase

Enter key password for <myalias> keytool error: java.security.UnrecoverableKeyException: Cannot recover key java.security.UnrecoverableKeyException: Cannot recover key at sun.security.provider.KeyProtector.recover(KeyProtector.java:328) – Testosterone

It's been a long time since I thought about this, but the only possibly relevant thing I can think of that isn't written here is that at some point after this all happened, we downloaded, kept, and used a previous version of the jar signing tools involved, because the newer ones wouldn't work anymore. That's all the info I've got. – Puzzlement

Answer 2

I had the same problem and I tried everything that is suggested in this thread but nothing was able to save my alias password. The point is that I was absolutely sure about the password, since I had updated the app four times already. I was getting the "Keystore was tampered with, or password was incorrect" message.

The solution

It appears that at the creation of the keystore using eclipse, a space character was added in front of the password!

This nasty bug was apparently fixed at a later version rendering me unable to sign my app with the password I thought was the correct one.

Based on this SO link: Ant fails to build signed apk after updating to android v20 I would suggest that you try adding a space character before of after your password.

Forcefeed

I had the same problem with Unity - 2 spaces in my case. Gotta be careful using copy/paste! Wasted 4 hours of my time. :( – Pacifistic

Answer 3

Try to remove .metadata folder in your workspace and clear all temp folders. If your keystore file isn't damaged and you have tried to reinstall Eclipse, ADT, Android SDK and Java SDK correctly, I don't see other possibly causes for this strange issue excluding .metadata cache files and\or some temp corruption.

Another suggestion

Try to use Portecle an utility for managing and examining keystores, keys, certificates, certificate requests, certificate revocation lists etc.

Voorhis

Alright, I moved the ".metadata" folder instead of deleting it. What other "temp" folders? – Iceboat

@JaredBurrows with the others temp folders I refer to the standard temp directory of your OS, the file created in this directory during the exporting usually are regenerated each time you export a project... however if you get this strange issue is another trial to do – Voorhis

I have edited my answer adding another suggestion. Hope this helps – Voorhis

Alright, so I finally had the time to erase my ".eclipse" and my ".metadata" folder. I re-installed the ADT plugin and imported the project I needed to export. For some reason I am still have trouble. – Iceboat

Answer 4

I will suggest couple of more heat and trials.

Have patience to apply these,

Steps:

1. Untick the build automatically (Project-> Build Automatically) in eclipse and clean your project.
2. Build it again.(Right Click on the project+Build Project)
3. Export Project.
4. Select Android Export.(auto aligned for you)
5. Choose your key. provide the password. alias should come in the list.(Be sure about the caps lock). Sometimes we give correct password but due to caps it always fails ;)
6. Let me know if it works for you.

Hopes this will help you.

Dapper

Alright, I have tried this and it is still does not work. Thank you though. – Iceboat

Answer 5

Just had this issue - all of a sudden Android Studio forgot my passwords and wouldn't use the ones I had in the gradle file. I've had the same keyfile and passwords in the same project for 6 years!

So I entered them manually - but it failed verification time after time. I tried some things like invalidating caches, restarting Android Studio and restoring a backup of the keystore but nothing helped.

Finally in pure desperation I tried to switch the keystore password and the key password. Lo and behold - it worked! Turns out I had switched the passwords when I entered them into the Gradle build file a few years ago, and for some reason I never noticed.

Conclusion: never be 100% sure that you're doing it right.

Secular

Answer 6

My key alias stoped working sudenly. (Ok, after few updates of Android Studio and Java).

I tried all solutions from this thread as well as from others. In my case the solution was surprising. I have the keystore with few aliases. None was working except one, which had password the same as keystore. But unfortunately it wasn't the one I needed. This made me thinking with no logic involved. I copied single alias to new keystore with

keytool -importkeystore -srckeystore old.keystore -destkeystore new.keystore -srcalias importantalias

And then I changed alias password to the same as keystore's password with:

keytool -keypasswd -keystore new.keystore -alias importantalias

Finally I was able to sign my apk. It looks like silly bug which can waste a day of development.

Parlous

This is the same answerfrom the "correct" answer on this thread. – Iceboat

I tried but i am getting error , keytool error: java.security.UnrecoverableKeyException: Cannot recover key – Testosterone

Answer 7

I battled this issue as well recently, and tried all suggestions listed here and elsewhere. Finally identified a silly mistake that was causing this error at my end - I wanted to share this here in case it helps any of you.

This is more likely to be the case if you, like me, have multiple Java versions on your machine and had upgraded JRE / JDK between the time you originally created the keystore and now when you're trying to sign the APK.

For some reason, our compile instructions were referencing the full Java path like this:

C:\Progra~1\Java\jdk1.6.0_45\bin\jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore cre80ve.keystore unsigned.apk cre80ve

One of the suggestions above got me thinking that it might not be a password issue at all, and it could be version incompatibilities causing the issue. So I ran the below command :

keytool -list -keystore cre80ve.keystore

Using the password that I knew was correct, and lo and behold, it confirmed that it was the right password.

I then dropped the explicit reference in the path to the (older) Java version. This made it automatically pick up the latest version of Java (jdk1.8.0_31 in my case):

jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore cre80ve.keystore unsigned.apk cre80ve

And everything started working fine!

Bottomline: it may not be a password issue at all, but different versions of Java or the Android SDK causing the issue, so remember to check that out.

And once it starts working, remember to backup your keystore and password in a safe place :-)

Advertise

Thanks for this: This is more likely to be the case if you, like me, have multiple Java versions on your machine and had upgraded JRE / JDK between the time you originally created the keystore and now when you're trying to sign the APK. I think this is what happened to me. – Iceboat

Answer 8

Are you storing values such as key.store.password or key.alias.password in your local.properties file? Are either of those incorrect?

I'm curious if there's some bug that occurs for keys created with JDK6 and verified in JDK7 - It would explain why the new keys you created for testing work, but the old one doesn't. Try downgrading to JDK6 and see if that fixes it- Others have had jarsigner trouble in JDK7 that went away when they downgraded to 6. If that works, file a bug report and demand a patch so you can safely upgrade to Java 7 :)

Teniers

Sorry for getting back to you so late, but how could I accidentally store these values in local.properties? Also, do you mean project.properties and not local.properties? – Iceboat

The values would be read in either one. local.properties is meant to store values that are specific to your machine that wouldn't go in source control (like path to SDK, path to keystore files, etc). project properties is for key/value pairs that are machine independant, like minimum/target API version. – Teniers

I looked and I did not find these files on my local computer. – Iceboat