Crash when AndroidKeyStoreKeyGeneratorSpi.engineGenerateKey

[duquewu]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.

Language and Async Model

Kotlin - Coroutines

Amplify Categories

Authentication

Gradle script dependencies

// Put output below this line
com.amplifyframework:aws-core:2.14.8
com.amplifyframework:aws-auth-cognito:2.14.8
com.amplifyframework:aws-storage-s3:2.14.8

Environment information

# Put output below this line

Please include any relevant guides or documentation you're referencing

No response

Describe the bug

Crashlytics

This issue has occurred 178 times and has affected 9 users.

87% Xiaomi
86% Android 9

Fatal Exception: java.security.ProviderException: Keystore operation failed
       at android.security.keystore.AndroidKeyStoreKeyGeneratorSpi.engineGenerateKey(AndroidKeyStoreKeyGeneratorSpi.java:318)
       at javax.crypto.KeyGenerator.generateKey(KeyGenerator.java:612)
       at androidx.security.crypto.MasterKeys.generateKey(MasterKeys.java:130)
       at androidx.security.crypto.MasterKeys.getOrCreate(MasterKeys.java:88)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository$sharedPreferences$2.invoke(EncryptedKeyValueRepository.kt:37)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository$sharedPreferences$2.invoke(EncryptedKeyValueRepository.kt:34)
       at kotlin.SynchronizedLazyImpl.getValue(LazyJVM.kt:74)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository.getSharedPreferences$com_amplifyframework_core_release(EncryptedKeyValueRepository.kt:34)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository.get(EncryptedKeyValueRepository.kt:56)
       at com.amplifyframework.auth.cognito.data.AWSCognitoAuthCredentialStore.retrieveCredential(AWSCognitoAuthCredentialStore.kt:63)
       at com.amplifyframework.auth.cognito.actions.CredentialStoreCognitoActions$loadCredentialStoreAction$$inlined$invoke$1.execute(Action.kt:70)
       at com.amplifyframework.statemachine.ConcurrentEffectExecutor$execute$1$1.invokeSuspend(ConcurrentEffectExecutor.kt:26)
       at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
       at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:108)
       at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.java:584)
       at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:793)
       at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:697)
       at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:684)

Caused by android.security.KeyStoreException: Memory allocation failed
       at android.security.KeyStore.getKeyStoreException(KeyStore.java:850)
       at android.security.keystore.AndroidKeyStoreKeyGeneratorSpi.engineGenerateKey(AndroidKeyStoreKeyGeneratorSpi.java:318)
       at javax.crypto.KeyGenerator.generateKey(KeyGenerator.java:612)
       at androidx.security.crypto.MasterKeys.generateKey(MasterKeys.java:130)
       at androidx.security.crypto.MasterKeys.getOrCreate(MasterKeys.java:88)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository$sharedPreferences$2.invoke(EncryptedKeyValueRepository.kt:37)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository$sharedPreferences$2.invoke(EncryptedKeyValueRepository.kt:34)
       at kotlin.SynchronizedLazyImpl.getValue(LazyJVM.kt:74)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository.getSharedPreferences$com_amplifyframework_core_release(EncryptedKeyValueRepository.kt:34)
       at com.amplifyframework.core.store.EncryptedKeyValueRepository.get(EncryptedKeyValueRepository.kt:56)
       at com.amplifyframework.auth.cognito.data.AWSCognitoAuthCredentialStore.retrieveCredential(AWSCognitoAuthCredentialStore.kt:63)
       at com.amplifyframework.auth.cognito.actions.CredentialStoreCognitoActions$loadCredentialStoreAction$$inlined$invoke$1.execute(Action.kt:70)
       at com.amplifyframework.statemachine.ConcurrentEffectExecutor$execute$1$1.invokeSuspend(ConcurrentEffectExecutor.kt:26)
       at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
       at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:108)
       at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.java:584)
       at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:793)
       at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:697)
       at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:684)

Reproduction steps (if applicable)

No response

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

amplifyconfiguration.json

No response

GraphQL Schema

// Put your schema below this line

Additional information and screenshots

No response

[mattcreaser]

Appears to be similar to #2548, in that it's another keystore error when attempting to retrieve the MasterKey. Both types of errors are called out in the Google Tracker bug here: https://issuetracker.google.com/issues/176215143.

We're looking into trying some kind of workaround, but the actual bug is lower-level than Amplify.

[antoineberthelin]

Hello @mattcreaser

FYI crashlytics report 5 users with this crash since 2 days on whosnext prod application.

Thanks

[mattcreaser]

Thanks @antoineberthelin.

According to the Tink issue here, there is no known way to recover the encrypted preferences when this error occurs, so the best option appears to be deleting the encrypted preferences file and the master key, and try to recreate them.

We'll need to inspect each use of the key-value repository class to determine what the potential impact of this change could be, but the expected result in the auth use case is that, if a master key becomes unreadable, the user will need to sign in again (since we will be deleting their locally-stored credentials).

I'm working on implementing the workaround, and I'll communicate my full understanding of the implications for user experience in this issue once it's ready.

[mattcreaser]

This workaround will be included in our next release.

The EncryptedKeyValueRepository has three distinct uses in Amplify today:

• Storing Auth credentials. This is the main use case, and where most of these crashes were occurring. With this workaround the behaviour users could see if there key becomes corrupted is that they have to sign back in to the application unexpectedly.
• Storing push notification device token: I don't believe end users will see any impact from this usage as the token is refetched on app launch.
• Storing CloudWatchLoggingPlugin database passphrase. The user should not see an impact in this usage, but it's possible that some logs are lost as they will be unrecoverable from the existing database.

[mattcreaser]

This has been released in Amplify 2.14.10 🎉

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.