Andotp: Failure to import exported OTP entries, success message wrongly shown.

[schoeke]

General information

• App version: 0.2.8
• App source: F-Droid
• Android Version: 7.1.2

Expected result

What is expected?
When importing an encrypted backup (generated using "Backup (encrypted)"), it should be possible to import it and the OTP entries should reappear.

What does happen instead?
After the message "Import from external storage successful.", the entries do not appear in the app.

Logcat

11-21 11:09:31.054  2587  2587 D SoftKeymaster: system/keymaster/soft_keymaster_device.cpp, Line 701: Requested digest(s) supported for algorithm 1 and purpose 1
11-21 11:09:31.054  2587  2587 D SoftKeymaster: system/keymaster/soft_keymaster_device.cpp, Line 1203: Operation supported by Keymaster QTI HAL, passing through to keymaster1 module
11-21 11:09:31.137  2587  2587 E keymaster1_device: Finish send cmd failed
11-21 11:09:31.137  2587  2587 E keymaster1_device: ret: 0
11-21 11:09:31.137  2587  2587 E keymaster1_device: resp->status: -1000
11-21 11:09:31.138  7677  7677 W System.err: java.security.InvalidKeyException: Failed to unwrap key
11-21 11:09:31.138  7677  7677 W System.err:    at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineUnwrap(AndroidKeyStoreCipherSpiBase.java:682)
11-21 11:09:31.138  7677  7677 W System.err:    at javax.crypto.Cipher.unwrap(Cipher.java:2435)
11-21 11:09:31.138  7677  7677 W System.err:    at org.shadowice.flocke.andotp.Utilities.SecretKeyWrapper.unwrap(SecretKeyWrapper.java:80)
11-21 11:09:31.138  7677  7677 W System.err:    at org.shadowice.flocke.andotp.Utilities.KeyStoreHelper.loadOrGenerateWrappedKey(KeyStoreHelper.java:114)
11-21 11:09:31.138  7677  7677 W System.err:    at org.shadowice.flocke.andotp.Utilities.DatabaseHelper.loadDatabase(DatabaseHelper.java:65)
11-21 11:09:31.138  7677  7677 W System.err:    at org.shadowice.flocke.andotp.View.EntriesCardAdapter.loadEntries(EntriesCardAdapter.java:102)
11-21 11:09:31.138  7677  7677 W System.err:    at org.shadowice.flocke.andotp.View.EntriesCardAdapter.<init>(EntriesCardAdapter.java:71)
11-21 11:09:31.138  7677  7677 W System.err:    at org.shadowice.flocke.andotp.Activities.MainActivity.onCreate(MainActivity.java:276)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.Activity.performCreate(Activity.java:6684)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1119)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2637)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2751)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.ActivityThread.handleRelaunchActivity(ActivityThread.java:4556)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.ActivityThread.-wrap19(ActivityThread.java)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1502)
11-21 11:09:31.138  7677  7677 W System.err:    at android.os.Handler.dispatchMessage(Handler.java:102)
11-21 11:09:31.138  7677  7677 W System.err:    at android.os.Looper.loop(Looper.java:154)
11-21 11:09:31.138  7677  7677 W System.err:    at android.app.ActivityThread.main(ActivityThread.java:6186)
11-21 11:09:31.138  7677  7677 W System.err:    at java.lang.reflect.Method.invoke(Native Method)
11-21 11:09:31.138  7677  7677 W System.err:    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
11-21 11:09:31.138  7677  7677 W System.err:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
11-21 11:09:31.138  7677  7677 W System.err: Caused by: javax.crypto.IllegalBlockSizeException
11-21 11:09:31.138  7677  7677 W System.err:    at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:519)
11-21 11:09:31.139  7677  7677 W System.err:    at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineUnwrap(AndroidKeyStoreCipherSpiBase.java:680)
11-21 11:09:31.139  7677  7677 W System.err:    ... 20 more
11-21 11:09:31.139  7677  7677 W System.err: Caused by: android.security.KeyStoreException: Unknown error
11-21 11:09:31.139  7677  7677 W System.err:    at android.security.KeyStore.getKeyStoreException(KeyStore.java:676)
11-21 11:09:31.139  7677  7677 W System.err:    at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:224)
11-21 11:09:31.139  7677  7677 W System.err:    at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:506)
11-21 11:09:31.139  7677  7677 W System.err:    ... 21 more

Steps to reproduce

• Exported, install LineageOS, import.
• I am not sure that I did anything different then that.

[flocke]

@schoeke Did you do a clean install of LineageOS? Which version of LineageOS are you using?
If you didn't do a clean install try clearing andOTPs data before importing.

[flocke]

@schoeke Probably a stupid question, but: did you set the same password you used to encrypt the backup in the settings before trying to import it?

[schoeke]

• Yes, it was a clean install.
• LineageOS: lineage-14.1-20171109-nightly
• I tried two things: Clean install and a Titanium backup. Both failed to import or to restore the entries.
• To my knowledge, I set the correct password, yes.

However! I did a complete reinstall of the app again in the mean time and manually purged the andOTP folder. This time, it seems like the import worked.

Closing the ticket and thank you for your time and the product. 😃

[flocke]

Strange.

With Titanium backup I can understand why it happens:
You get the encrypted files in the andOTP folder from the backup but not the encryption key in the KeyStore. As a result andOTP generates a new key in the KeyStore, which obviously doesn't match your encrypted files from the backup.

But if you clean the apps data (or have a clean install) it should delete all files and start fresh, so I don't really get why it didn't work for you the first time.

Good it solved itself somehow, I was afraid it was another instance of #16.

[schoeke]

I assume that I made a mistake somehow. It might be that when I first put backed up data on the phone again that I forgot to not restore andOTP. When I realized it, I uninstalled it but not the data. Probably something like that.