IssueTracker

Component used: EncryptedSharedPreferences from androidx.security:security-crypto

Version used: 1.1.0-alpha03

Devices/Android versions reproduced on: Pixel 5a 5G, Pixel 5, Pixel 4a (5G), Pixel 7, OnePlus Nord n200 5g, Galaxy A51 5G

When calling

private fun initializeEncryptedSharedPreferencesManager(): SharedPreferences {
    val masterKey = MasterKey.Builder(context, DEFAULT_MASTER_KEY_ALIAS)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM).build()

    return EncryptedSharedPreferences.create(
        context,
        ENCRYPTED_PREFERENCES_NAME,
        masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
    )
}

I get the following error

      Caused by java.security.KeyStoreException: the master key android-keystore://_androidx_security_master_key_ exists but is unusable
   at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.readOrGenerateNewMasterKey(:99)
   at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.build(:5)
   at androidx.security.crypto.EncryptedSharedPreferences.create(:54)
   at androidx.security.crypto.EncryptedSharedPreferences.create(:4)

Caused by java.security.InvalidKeyException
Keystore operation failed
      Caused by java.security.InvalidKeyException: Keystore operation failed
   at android.security.keystore2.KeyStoreCryptoOperationUtils.getInvalidKeyException(KeyStoreCryptoOperationUtils.java:128)
   at android.security.keystore2.KeyStoreCryptoOperationUtils.getExceptionForCipherInit(KeyStoreCryptoOperationUtils.java:152)
   at android.security.keystore2.AndroidKeyStoreCipherSpiBase.ensureKeystoreOperationInitialized(AndroidKeyStoreCipherSpiBase.java:360)
   at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineInit(AndroidKeyStoreCipherSpiBase.java:188)
   at javax.crypto.Cipher.tryTransformWithProvider(Cipher.java:3003)
   at javax.crypto.Cipher.tryCombinations(Cipher.java:2910)
   at javax.crypto.Cipher$SpiAndProviderUpdater.updateAndGetSpiAndProvider(Cipher.java:2815)
   at javax.crypto.Cipher.chooseProvider(Cipher.java:792)
   at javax.crypto.Cipher.init(Cipher.java:1162)
   at javax.crypto.Cipher.init(Cipher.java:1103)
   at com.google.crypto.tink.integration.android.AndroidKeystoreAesGcm.encryptInternal(:23)
   at com.google.crypto.tink.integration.android.AndroidKeystoreAesGcm.encrypt(:16)
   at com.google.crypto.tink.integration.android.AndroidKeystoreKmsClient.validateAead(:9)
   at com.google.crypto.tink.integration.android.AndroidKeystoreKmsClient.getAead(:48)
   at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.readOrGenerateNewMasterKey(:69)
   at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.build(:5)
   at androidx.security.crypto.EncryptedSharedPreferences.create(:54)
   at androidx.security.crypto.EncryptedSharedPreferences.create(:4)


Caused by android.security.KeyStoreException
-22 (internal Keystore code: -22 message: 
system/security/keystore2/src/security_level.rs:357: Failed to begin operation. Caused 
by: 0: system/security/keystore2/src/security_level.rs:868 1: 
system/security/keystore2/src/utils.rs:429: Calling km_op. 2: 
Error::Km(r#KEY_EXPORT_OPTIONS_INVALID))

      Caused by android.security.KeyStoreException: -22 (internal Keystore code: -22 message: system/security/keystore2/src/security_level.rs:357: Failed to begin operation.

Caused by:
0: system/security/keystore2/src/security_level.rs:868
1: system/security/keystore2/src/utils.rs:429: Calling km_op.
2: Error::Km(r#KEY_EXPORT_OPTIONS_INVALID))
   at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:416)
   at android.security.KeyStoreSecurityLevel.createOperation(KeyStoreSecurityLevel.java:122)
   at android.security.keystore2.AndroidKeyStoreCipherSpiBase.ensureKeystoreOperationInitialized(AndroidKeyStoreCipherSpiBase.java:355)
   at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineInit(AndroidKeyStoreCipherSpiBase.java:188)
   at javax.crypto.Cipher.tryTransformWithProvider(Cipher.java:3003)
   at javax.crypto.Cipher.tryCombinations(Cipher.java:2910)
   at javax.crypto.Cipher$SpiAndProviderUpdater.updateAndGetSpiAndProvider(Cipher.java:2815)
   at javax.crypto.Cipher.chooseProvider(Cipher.java:792)
   at javax.crypto.Cipher.init(Cipher.java:1162)
   at javax.crypto.Cipher.init(Cipher.java:1103)
   at com.google.crypto.tink.integration.android.AndroidKeystoreAesGcm.encryptInternal(:23)
   at com.google.crypto.tink.integration.android.AndroidKeystoreAesGcm.encrypt(:16)
   at com.google.crypto.tink.integration.android.AndroidKeystoreKmsClient.validateAead(:9)
   at com.google.crypto.tink.integration.android.AndroidKeystoreKmsClient.getAead(:48)
   at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.readOrGenerateNewMasterKey(:69)
   at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.build(:5)
   at androidx.security.crypto.EncryptedSharedPreferences.create(:54)
   at androidx.security.crypto.EncryptedSharedPreferences.create(:4)