android.security.KeyStoreException: Invalid operation handle #235

DenBond7 · 2018-04-05T05:19:31Z

[STACK_TRACE]
com.flowcrypt.email.util.exception.ManualHandledException: Handled manually:
        at com.flowcrypt.email.util.exception.ExceptionUtil.handleError(ExceptionUtil.java:88)
        at com.flowcrypt.email.security.SecurityStorageConnector.init(SecurityStorageConnector.java:106)
        at com.flowcrypt.email.security.SecurityStorageConnector.<init>(SecurityStorageConnector.java:36)
        at com.flowcrypt.email.js.JsInBackgroundManager$JsRunnable.run(JsInBackgroundManager.java:190)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
        at java.util.concurrent.FutureTask.run(FutureTask.java:237)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
        at java.lang.Thread.run(Thread.java:818)
Caused by: javax.crypto.IllegalBlockSizeException
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:486)
        at javax.crypto.Cipher.doFinal(Cipher.java:1502)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.decryptWithRSA(KeyStoreCryptoManager.java:253)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.initAesSecretKeySpec(KeyStoreCryptoManager.java:271)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.<init>(KeyStoreCryptoManager.java:100)
        at com.flowcrypt.email.security.SecurityUtils.getPrivateKeysInfo(SecurityUtils.java:40)
        at com.flowcrypt.email.security.SecurityStorageConnector.init(SecurityStorageConnector.java:99)
        ... 7 more
Caused by: android.security.KeyStoreException: Invalid operation handle
        at android.security.KeyStore.getKeyStoreException(KeyStore.java:665)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.update(KeyStoreCryptoOperationChunkedStreamer.java:132)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:217)
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:473)
        ... 13 more
javax.crypto.IllegalBlockSizeException
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:486)
        at javax.crypto.Cipher.doFinal(Cipher.java:1502)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.decryptWithRSA(KeyStoreCryptoManager.java:253)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.initAesSecretKeySpec(KeyStoreCryptoManager.java:271)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.<init>(KeyStoreCryptoManager.java:100)
        at com.flowcrypt.email.security.SecurityUtils.getPrivateKeysInfo(SecurityUtils.java:40)
        at com.flowcrypt.email.security.SecurityStorageConnector.init(SecurityStorageConnector.java:99)
        at com.flowcrypt.email.security.SecurityStorageConnector.<init>(SecurityStorageConnector.java:36)
        at com.flowcrypt.email.js.JsInBackgroundManager$JsRunnable.run(JsInBackgroundManager.java:190)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
        at java.util.concurrent.FutureTask.run(FutureTask.java:237)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
        at java.lang.Thread.run(Thread.java:818)
Caused by: android.security.KeyStoreException: Invalid operation handle
        at android.security.KeyStore.getKeyStoreException(KeyStore.java:665)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.update(KeyStoreCryptoOperationChunkedStreamer.java:132)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:217)
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:473)
        ... 13 more
android.security.KeyStoreException: Invalid operation handle
        at android.security.KeyStore.getKeyStoreException(KeyStore.java:665)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.update(KeyStoreCryptoOperationChunkedStreamer.java:132)
        at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:217)
        at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:473)
        at javax.crypto.Cipher.doFinal(Cipher.java:1502)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.decryptWithRSA(KeyStoreCryptoManager.java:253)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.initAesSecretKeySpec(KeyStoreCryptoManager.java:271)
        at com.flowcrypt.email.security.KeyStoreCryptoManager.<init>(KeyStoreCryptoManager.java:100)
        at com.flowcrypt.email.security.SecurityUtils.getPrivateKeysInfo(SecurityUtils.java:40)
        at com.flowcrypt.email.security.SecurityStorageConnector.init(SecurityStorageConnector.java:99)
        at com.flowcrypt.email.security.SecurityStorageConnector.<init>(SecurityStorageConnector.java:36)
        at com.flowcrypt.email.js.JsInBackgroundManager$JsRunnable.run(JsInBackgroundManager.java:190)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:423)
        at java.util.concurrent.FutureTask.run(FutureTask.java:237)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1113)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:588)
        at java.lang.Thread.run(Thread.java:818)

The text was updated successfully, but these errors were encountered:

DenBond7 · 2018-04-05T05:19:49Z

ref https://mail.google.com/mail/u/0/#inbox/16292fdf4e865eef

DenBond7 · 2018-04-16T07:08:53Z

It looks like a platform bug. I'm closing it.
https://stackoverflow.com/questions/39859579/how-come-i-cannot-perform-multiple-keystore-cipher-decryptions-on-samsung-s6-and

I have not found "Invalid operation handle" in the source code.

https://github.com/aosp-mirror/platform_frameworks_base/blob/bde42b56b84fb2f184f83f2a00fb00a1bd4db22e/keystore/java/android/security/KeyStore.java#L600

DenBond7 · 2019-03-05T10:56:36Z

https://mail.google.com/mail/u/0/#search/label%3Awork-flowcrypt-crashes+label%3Aunread+IllegalBlockSizeException/FMfcgxwBVqQBGhtqlVLJgJffStXngvKp

Huawei Mate 20

DenBond7 · 2019-03-05T10:57:51Z

https://mail.google.com/mail/u/0/#search/label%3Awork-flowcrypt-crashes+label%3Aunread+IllegalBlockSizeException/FMfcgxwBVgsZwbdnLZbNPljLLFFmVPlZ
Samsung Galaxy S7(SM-G935F)

f4grx · 2019-03-07T13:49:24Z

Hello,

In my app, the combo "IllegalBlockSizeException" caused by "android.security.KeyStoreException: Invalid operation handle" happens because the Cipher classes used with Keystore keys are not thread safe.

-Synchronizing only calls to doFinal() did not help
-Synchronizing the whole cipher operation, from Cipher.getInstance() to doFinal worked.

DenBond7 · 2019-03-07T14:52:21Z

Hello @f4grx
Could you provide more details?

Android version
Device model
Is that a custom ROM?

f4grx · 2019-03-07T15:23:55Z

I tested on 3 of my phones:
Galaxy Note 2 (SVH-E250S) with lineage os 14, so yes, custom, android is 7.1.2
Pixel 2 with android 9
Galaxy S4 Mini with kitkat

So it may be quite common. I did not test other phones but I am reasonably sure most of them have the same issues.

tomholub · 2019-03-07T20:58:07Z

@DenBond7 I think @f4grx was trying to say that as an Android developer he encountered the same issue when developing his own app too.

And the solution was to synchronize the whole cipher operation, from Cipher.getInstance() to doFinal to be done on a single thread.

DenBond7 · 2019-03-08T12:41:06Z

I think @f4grx was trying to say that as an Android developer he encountered the same issue when developing his own app too.

@tomholub I understood it. I just need more details. Info about devices is very useful.
For example, here @Unlimity says that Samsung's Cipher maybe is not thread-safe.

f4grx · 2019-03-08T13:03:45Z

Yes, this is the page that gave me the idea of Cipher synchronization.

But who really provides this implementation? Is it really Samsung? I may have seen mentions of BouncyCastle. The Pixel2 is made by HTC and lineage possibly don't use any Samsung code.

DenBond7 · 2019-03-08T13:16:21Z

@f4grx

lineage possibly don't use any Samsung code.

We have one more issue like this. Some devices with LineageOS have a problem with encryption/decryption.

Unfortunately, I don't have any devices with LineageOS yet. But I have Nexus 4(I know it's an old device :)) and I'm going to install LineageOS. Then I'll be able to test the app.

DenBond7 · 2019-04-17T12:55:56Z

@f4grx @tomholub

But I have Nexus 4(I know it's an old device :)) and I'm going to install LineageOS. Then I'll be able to test the app.

I've tested the app on different versions of LineageOs. Unfortunately, I've received no errors. The app works well. So I still can't reproduce such errors.

I've made the decryption block as synchronized. I hope these changes will solve the problem (or give me more details)

See details here https://weidianhuang.medium.com/how-to-write-thread-safe-code-for-android-keystore-40a0fa17f416

DenBond7 added the bug label Apr 5, 2018

DenBond7 added this to the 0.6.2: Display signed messages milestone Apr 5, 2018

DenBond7 self-assigned this Apr 5, 2018

DenBond7 added the device_platform_bug label Apr 16, 2018

DenBond7 closed this as completed Apr 16, 2018

tomholub added the won't test label Apr 26, 2018

DenBond7 reopened this Mar 5, 2019

DenBond7 modified the milestones: 0.6.2: Display signed messages, rare bugs Mar 5, 2019

DenBond7 mentioned this issue Mar 31, 2019

KeyStoreCryptoManager: Use only AES #492

Closed

DenBond7 modified the milestones: rare bugs, 0.7.5 Apr 2, 2019

DenBond7 added a commit that referenced this issue Apr 17, 2019

Made KeyStoreCryptoManager.decryptWithRSAOrAES synchronized.| #235

cc2f95b

DenBond7 modified the milestones: 0.7.5, rare bugs Apr 17, 2019

DenBond7 modified the milestones: rare bugs, 1.1.6 Feb 11, 2021

DenBond7 removed this from the 1.1.6 milestone Feb 22, 2021

DenBond7 added this to the 1.1.5 milestone Feb 22, 2021

DenBond7 added a commit that referenced this issue Feb 22, 2021

Made KeyStoreCryptoManager.encrypt/decrypt() synchronized.| Close #235

6b553f9

See details here https://weidianhuang.medium.com/how-to-write-thread-safe-code-for-android-keystore-40a0fa17f416

DenBond7 closed this as completed Feb 22, 2021

rishabh876 mentioned this issue Jan 10, 2024

KVault.set() uses sharedPreferences.commit() instead of sharedPreferences.apply() Liftric/KVault#49

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

android.security.KeyStoreException: Invalid operation handle #235

android.security.KeyStoreException: Invalid operation handle #235

DenBond7 commented Apr 5, 2018

DenBond7 commented Apr 5, 2018

DenBond7 commented Apr 16, 2018

DenBond7 commented Mar 5, 2019

DenBond7 commented Mar 5, 2019 •

edited

Loading

f4grx commented Mar 7, 2019

DenBond7 commented Mar 7, 2019

f4grx commented Mar 7, 2019 •

edited

Loading

tomholub commented Mar 7, 2019

DenBond7 commented Mar 8, 2019

f4grx commented Mar 8, 2019

DenBond7 commented Mar 8, 2019

DenBond7 commented Apr 17, 2019

android.security.KeyStoreException: Invalid operation handle #235

android.security.KeyStoreException: Invalid operation handle #235

Comments

DenBond7 commented Apr 5, 2018

DenBond7 commented Apr 5, 2018

DenBond7 commented Apr 16, 2018

DenBond7 commented Mar 5, 2019

DenBond7 commented Mar 5, 2019 • edited Loading

f4grx commented Mar 7, 2019

DenBond7 commented Mar 7, 2019

f4grx commented Mar 7, 2019 • edited Loading

tomholub commented Mar 7, 2019

DenBond7 commented Mar 8, 2019

f4grx commented Mar 8, 2019

DenBond7 commented Mar 8, 2019

DenBond7 commented Apr 17, 2019

DenBond7 commented Mar 5, 2019 •

edited

Loading

f4grx commented Mar 7, 2019 •

edited

Loading