mCodex/react-native-sensitive-info

Decryption failing on certain Android devices

geraintwhite opened this issue · 0 comments

Calling getItem fails with a javax.crypto.AEADBadTagException error on certain Android devices.

It happens for me on my Huawei P30 with Android 9, but doesn't happen on my Pixel 4 with Android 11, Samsung S10 with Android 11, Samsung S20 with Android 10, Samsung S9 with Android 9.

This appears to be related to some devices failing to decrypt when the message is too large (https://androidforums.com/threads/aeadbadtagexception-caused-by-keystoreexception-signature-mac-verification-failed.1327080/).

javax.crypto.AEADBadTagException
    at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:517)
    at javax.crypto.Cipher.doFinal(Cipher.java:2055)
    at dev.mcodex.RNSensitiveInfo.RNSensitiveInfoModule.decrypt(RNSensitiveInfoModule.java:677)
    at dev.mcodex.RNSensitiveInfo.RNSensitiveInfoModule.getItem(RNSensitiveInfoModule.java:195)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.facebook.react.bridge.JavaMethodWrapper.invoke(JavaMethodWrapper.java:372)
    at com.facebook.react.bridge.JavaModuleWrapper.invoke(JavaModuleWrapper.java:151)
    at com.facebook.react.bridge.queue.NativeRunnable.run(Native Method)
    at android.os.Handler.handleCallback(Handler.java:907)
    at android.os.Handler.dispatchMessage(Handler.java:105)
    at com.facebook.react.bridge.queue.MessageQueueThreadHandler.dispatchMessage(MessageQueueThreadHandler.java:27)
    at android.os.Looper.loop(Looper.java:216)
    at com.facebook.react.bridge.queue.MessageQueueThreadImpl$4.run(MessageQueueThreadImpl.java:226)
    at java.lang.Thread.run(Thread.java:784)
Caused by: android.security.KeyStoreException: Signature/MAC verification failed
    at android.security.KeyStore.getKeyStoreException(KeyStore.java:851)
    at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:224)
    at android.security.keystore.AndroidKeyStoreAuthenticatedAESCipherSpi$BufferAllOutputUntilDoFinalStreamer.doFinal(AndroidKeyStoreAuthenticatedAESCipherSpi.java:373)
    at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:506)