Android-password-store: [BUG] Can't generate an ed25519 key

[blastrock]

Describe the bug
When I generate an ed25519 key I get "Error while trying to generate the ssh-key" "Message : the master key android-keystore://sshkey exists but is unusable".

To Reproduce
Steps to reproduce the behavior:

1. Start the app (for the first time or not)
2. Follow the tutorial until it asks you to generate a key, or go to settings -> generate ssh key pair
3. Select ed25519
4. Click on generate

Expected behavior
Success

Device information:

• Device: Oneplus 3T
• OS: Lineage 16 (Android 9)
• App version 1.12.0

[fmeum]

Lineage 16 has had some Issues with the Android Keystore in the past, so it's hard to say whether this isn't just a custom ROM bug.

Have you tried this with both screen lock protection enabled and disabled?

[fmeum]

According to this Tink issue, the issue is that the Android Keystore appears to be broken on OnePlus 3T.

@msfjarvis As we already delete the key prior to recreating it, there doesn't seem to be anything else we can do about this: Tink's self-test for broken Keystore implementations apparently fails to detect the issue, but androidx.security does not provide an API to manually disable Keystore.

[msfjarvis]

According to this Tink issue, the issue is that the Android Keystore appears to be broken on OnePlus 3T.

@msfjarvis As we already delete the key prior to recreating it, there doesn't seem to be anything else we can do about this: Tink's self-test for broken Keystore implementations apparently fails to detect the issue, but androidx.security does not provide an API to manually disable Keystore.

For the first time in 3 years I truly regret the theft of my 3T. I'll try to confirm that the selftest indeed fails and file an issue.

[blastrock]

Have you tried this with both screen lock protection enabled and disabled?

Yes, and both generation of the key and cloning of the repo work with screen lock protection disabled.

You speak about a selftest, would running it on my phone help? Can I find it on the store? Would I need to compile one?

[msfjarvis]

Have you tried this with both screen lock protection enabled and disabled?

Yes, and both generation of the key and cloning of the repo work with screen lock protection disabled.

You speak about a selftest, would running it on my phone help? Can I find it on the store? Would I need to compile one?

I simply added the code Tink was using to my side project and had a 3T user test it on his device. If you wish to compile it yourself, I've pushed the self-test to the tink-test branch. It should show a toast message at the bottom with the self-test result. Here is an APK if you need it.

[blastrock]

Thanks, I tried the APK and the self-test passed on my device too. Let's wait for Tink's answer then, thanks for your help!

[blastrock]

Hi, I have upgraded to Lineage 17.1 from December 7th and the issue is now fixed, we can close this I think.