IssueTracker

Hi,

We are getting multiple reports from our clients that a recent update (maybe 2025-03-05 ?) has broken our apps when they are installed in a work profile with One Lock turned on.

This seems similar to https://issuetracker.google.com/issues/375244071 but before it was only affecting pin protected keys (KeyProperties.AUTH_DEVICE_CREDENTIAL) now it seems to affect biometric protected keys (KeyProperties.AUTH_BIOMETRIC_STRONG) that our app use.

This is the stacktrace that we have seen:

2025-03-06T16:31:30.681353Z ERROR 	 TokenViewModel - Failed to get code from challenge java.security.SignatureException: android.security.KeyStoreException: Key user not authenticated (internal Keystore code: -26 message: system/security/keystore2/src/operation.rs:847: KeystoreOperation::finish

Caused by:
    0: system/security/keystore2/src/operation.rs:428: Finish failed.
    1: Error::Km(r#KEY_USER_NOT_AUTHENTICATED)) (public error code: 2 internal Keystore code: -26)
	at android.security.keystore2.AndroidKeyStoreSignatureSpiBase.engineSign(AndroidKeyStoreSignatureSpiBase.java:332)
	at java.security.Signature$Delegate.engineSign(Signature.java:1422)
	at java.security.Signature.sign(Signature.java:743)
	at com.bloomberg.android.bUnit.tokenAuth.TokenViewModel.l(Unknown Source:125)
	at m3.J.p(Unknown Source:16)
	at D5.a.m(Unknown Source:8)
	at d7.D.run(Unknown Source:114)
	at android.os.Handler.handleCallback(Handler.java:991)
	at android.os.Handler.dispatchMessage(Handler.java:102)
	at android.os.Looper.loopOnce(Looper.java:232)
	at android.os.Looper.loop(Looper.java:317)
	at android.app.ActivityThread.main(ActivityThread.java:8934)
	at java.lang.reflect.Method.invoke(Native Method)
	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:591)
	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:911)
Caused by: android.security.KeyStoreException: Key user not authenticated (internal Keystore code: -26 message: system/security/keystore2/src/operation.rs:847: KeystoreOperation::finish

Caused by:
    0: system/security/keystore2/src/operation.rs:428: Finish failed.
    1: Error::Km(r#KEY_USER_NOT_AUTHENTICATED)) (public error code: 2 internal Keystore code: -26)
	at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:428)
	at android.security.KeyStoreOperation.handleExceptions(KeyStoreOperation.java:79)
	at android.security.KeyStoreOperation.finish(KeyStoreOperation.java:132)
	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer$MainDataStream.finish(KeyStoreCryptoOperationChunkedStreamer.java:228)
	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:181)
	at android.security.keystore2.AndroidKeyStoreSignatureSpiBase.engineSign(AndroidKeyStoreSignatureSpiBase.java:328)
	... 14 more

Disabling one lock in Settings > Security and privacy > More security and privacy > "Use one lock" seems to fix the issue.

Device: Pixel 9 Pro Android Version: 15 Build Number: BP1A.250305.020.A2

Will upload our app logs and a bugreport in a following note.