Crash on device with javax.crypto.AEADBadTagException

[marcprux]

Reported on the Skip Slack:

javax.crypto.AEADBadTagException
    at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:632)
    at javax.crypto.Cipher.doFinal(Cipher.java:2114)
    at com.google.crypto.tink.integration.android.AndroidKeystoreAesGcm.decryptInternal(AndroidKeystoreAesGcm.java:115)
    at com.google.crypto.tink.integration.android.AndroidKeystoreAesGcm.decrypt(AndroidKeystoreAesGcm.java:101)
    at com.google.crypto.tink.KeysetHandle.decrypt(KeysetHandle.java:217)
    at com.google.crypto.tink.KeysetHandle.read(KeysetHandle.java:118)
    at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.read(AndroidKeysetManager.java:311)
    at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.readOrGenerateNewKeyset(AndroidKeysetManager.java:287)
    at com.google.crypto.tink.integration.android.AndroidKeysetManager$Builder.build(AndroidKeysetManager.java:238)
    at androidx.security.crypto.EncryptedSharedPreferences.create(EncryptedSharedPreferences.java:123)
    at skip.keychain.Keychain.initializePreferences(SkipKeychain.kt:121)
    at skip.keychain.Keychain.set(SkipKeychain.kt:70)
    at skip.keychain.Keychain.set$default(SkipKeychain.kt:67)
    at CLIENT_CODE.successfulLogin(SessionManager.kt:355)
    at skip.foundation.DispatchQueue$async$1.invokeSuspend(Dispatch.kt:94)
    at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
    at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:101)
    at android.os.Handler.handleCallback(Handler.java:958)
    at android.os.Handler.dispatchMessage(Handler.java:99)
    at android.os.Looper.loopOnce(Looper.java:230)
    at android.os.Looper.loop(Looper.java:319)
    at android.app.ActivityThread.main(ActivityThread.java:8919)
    at java.lang.reflect.Method.invoke(Native Method)
    at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:578)
    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1103)
Caused by: android.security.KeyStoreException: Signature/MAC verification failed (internal Keystore code: -30 message: system/security/keystore2/src/operation.rs:850: KeystoreOperation::finish

Caused by:
    0: system/security/keystore2/src/operation.rs:426: Finish failed.
    1: Error::Km(r#VERIFICATION_FAILED)) (public error code: 10 internal Keystore code: -30)
    at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:435)
    at android.security.KeyStoreOperation.handleExceptions(KeyStoreOperation.java:78)
    at android.security.KeyStoreOperation.finish(KeyStoreOperation.java:128)
    at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer$MainDataStream.finish(KeyStoreCryptoOperationChunkedStreamer.java:228)
    at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:181)
    at android.security.keystore2.AndroidKeyStoreAuthenticatedAESCipherSpi$BufferAllOutputUntilDoFinalStreamer.doFinal(AndroidKeyStoreAuthenticatedAESCipherSpi.java:396)
    at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:624)
    ... 28 more

[marcprux]

Possibly related to tink-crypto/tink-java#23 (found via celest-dev/dart-packages#28).

One suggested workaround is to set the AndroidManifest.xml metadata:

android:allowBackup="false"

[aabewhite]

I've updated the skip-keychain README to instruct users to exclude the encrypted shared preferences file from their apps' backups. I've also added code to catch the exception and delete the un-decryptable file and start with a new one. These are the recommended strategies we've found.

I haven't reproduced the error, so unfortunately these are "blind" fixes.