AndroidKeyStore KeyPairGenerator Crashes On Small Number of Devices

Question

My application only targets Android 6.0+. In my application I generate a RSA key in the AndroidKeyStore with the following:

KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore");
kpg.initialize(new KeyGenParameterSpec.Builder(
    "myKey", KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
    .setCertificateSubject(new X500Principal("CN=myKey"))
    .setDigests("SHA-1")
    .setEncryptionPaddings("OAEPPadding")
    .build());

KeyPair kp = kpg.generateKeyPair();

This works well on 20+ devices that we have tested and nearly 100% percent of our users.

However, there is a small number of users that that application crashes for when kpg.generateKeyPair() is executed with the following:

java.security.ProviderException: Failed to load generated key pair from keystore
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:518)
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:470)
at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:699)
at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.n_onCreate(Native Method)
at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.onCreate(MainApplication.java:34)
at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1025)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5448)
at android.app.ActivityThread.-wrap2(ActivityThread.java)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:154)
at android.app.ActivityThread.main(ActivityThread.java:6186)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
Caused by: java.security.UnrecoverableKeyException: Failed to obtain X.509 form of public key
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:230)
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:259)
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:509)
... 14 more
Caused by: android.security.KeyStoreException: -22
at android.security.KeyStore.getKeyStoreException(KeyStore.java:676)
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:231)
... 16 more


java.security.UnrecoverableKeyException: Failed to obtain X.509 form of public key
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:230)
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:259)
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:509)
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:470)
at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:699)
at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.n_onCreate(Native Method)
at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.onCreate(MainApplication.java:34)
at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1025)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5448)
at android.app.ActivityThread.-wrap2(ActivityThread.java)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:154)
at android.app.ActivityThread.main(ActivityThread.java:6186)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
Caused by: android.security.KeyStoreException: -22
at android.security.KeyStore.getKeyStoreException(KeyStore.java:676)
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:231)
... 16 more


android.security.KeyStoreException: -22
at android.security.KeyStore.getKeyStoreException(KeyStore.java:676)
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:231)
at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:259)
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:509)
at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:470)
at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:699)
at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.n_onCreate(Native Method)
at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.onCreate(MainApplication.java:34)
at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1025)
at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5448)
at android.app.ActivityThread.-wrap2(ActivityThread.java)
at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564)
at android.os.Handler.dispatchMessage(Handler.java:102)
at android.os.Looper.loop(Looper.java:154)
at android.app.ActivityThread.main(ActivityThread.java:6186)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)

The only things I can find on the internet about this Failed to obtain X.509 form of public key error are a few articles with no real solutions. See:

• https://github.com/AzureAD/azure-activedirectory-library-for-android/issues/740
• https://jira.lineageos.org/browse/BUGBASH-454

The few reports that we have received are from users with OnePlus devices on Android 7.1, which is also one of the devices mentioned in the above articles but there are definitely other devices affected as well.

• Why is this happening?
• Are there any workarounds?

Fraley

I think that -22 corresponds to this: "KM_ERROR_KEY_EXPORT_OPTIONS_INVALID = -22" in KeyMasterDefs – Astridastride

Any ideas as to how I could resolve that? – Fraley

Seems to be stemming from this line: android.googlesource.com/platform/frameworks/base/+/refs/heads/… – Fraley

@Fraley I am actually one of the affected users, running a OnePlus 2. I TP-Links app "Kasa" crashing on me, with this exactly stack trace. Decompilation of the APK points to code looking like yours. Have you got any new information? – Friendly

@Friendly Unfortunately I was never able to solve the problem. I gave up on it. My solution was to forego using asymmetric keypairs and revert to use symmetric keys (on Android 6.0+). Fortunately my solution allowed for that, but I realize that isn't the case most of the time. – Fraley

@Fraley did you find a solution for this issue? – Davin

See comment above. – Fraley

Can you use Bouncy Castle or OpenSSL instead of AndroidKeyStore? – Cates

I'm curious what is the meaning of that error code: KM_ERROR_KEY_EXPORT_OPTIONS_INVALID and KEY_EXPORT_OPTIONS_INVALID. Is it will be return by specific implement of Phone/HW vender so we don't see detail implement of that return? In my case majority of that error is from Oppo vendor (~70%) – Underlaid

Answer 1

you must have to try this one...

• "SHA-256" instead of "SHA-1"

setDigests("SHA-256")

Zinfandel

Why? developer.android.com/reference/android/security/keystore/… – Gosser