AEADBadTagException when calling getStorage

[guy-utila]

Hi,

I am getting the following exception when calling getStorage on some Android device. Could this be because of an added fingerprint? If so, how should I handle this?

PlatformException: PlatformException(Unexpected Error, null, javax.crypto.AEADBadTagException
javax.crypto.AEADBadTagException
at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:632)
at javax.crypto.Cipher.doFinal(Cipher.java:2114)
at xa.l.a(CryptographyManager.kt:49)
at xa.d.l(BiometricStorageFile.kt:44)
at xa.f$m$a.a(BiometricStoragePlugin.kt:20)
at xa.f$m$a.invoke(BiometricStoragePlugin.kt:5)
at xa.f.r(BiometricStoragePlugin.kt:54)
at xa.f.h(BiometricStoragePlugin.kt:1)
at xa.f$m.a(BiometricStoragePlugin.kt:28)
at xa.f$m.invoke(BiometricStoragePlugin.kt:3)
at xa.f.u(BiometricStoragePlugin.kt:17)
at xa.f.b(BiometricStoragePlugin.kt:160)
at ub.j$a.a(MethodChannel.java:18)
at ib.c.l(DartMessenger.java:19)
at ib.c.m(DartMessenger.java:42)
at ib.c.i(Unknown Source:0)
at ib.b.run(Unknown Source:12)
at android.os.Handler.handleCallback(Handler.java:958)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loopOnce(Looper.java:230)
at android.os.Looper.loop(Looper.java:319)
at android.app.ActivityThread.main(ActivityThread.java:8919)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:578)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1103)
Caused by: android.security.KeyStoreException: Signature/MAC verification failed (internal Keystore code: -30 message: system/security/keystore2/src/operation.rs:850: KeystoreOperation::finish

Caused by:
0: system/security/keystore2/src/operation.rs:426: Finish failed.
1: Error::Km(r#VERIFICATION_FAILED)) (public error code: 10 internal Keystore code: -30)
at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:435)
at android.security.KeyStoreOperation.handleExceptions(KeyStoreOperation.java:78)
at android.security.KeyStoreOperation.finish(KeyStoreOperation.java:128)
at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer$MainDataStream.finish(KeyStoreCryptoOperationChunkedStreamer.java:228)
at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:181)
at android.security.keystore2.AndroidKeyStoreAuthenticatedAESCipherSpi$BufferAllOutputUntilDoFinalStreamer.doFinal(AndroidKeyStoreAuthenticatedAESCipherSpi.java:396)
at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:624)
... 24 more
, null)
#0 StandardMethodCodec.decodeEnvelope (/opt/hostedtoolcache/flutter/stable-3.22.2-x64/packages/flutter/lib/src/services/message_codecs.dart:648)
#1 MethodChannel._invokeMethod (/opt/hostedtoolcache/flutter/stable-3.22.2-x64/packages/flutter/lib/src/services/platform_channel.dart:334)

[shan-shaji]

I’m experiencing the same issue, but surprisingly it only occurs on certain devices (e.g., Motorola Edge 50 Neo running Android 15). Writing to storage works, but when trying to read, I get this exception.

Stacktrace:

javax.crypto.AEADBadTagException
javax.crypto.AEADBadTagException
	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:632)
	at javax.crypto.Cipher.doFinal(Cipher.java:2132)
	at A.g.n(SourceFile:59)
	at C0.u.g(SourceFile:53)
	at C0.z.h(SourceFile:9)
	at C0.p.run(SourceFile:79)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:524)
	at java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1156)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:651)
	at java.lang.Thread.run(Thread.java:1119)
Caused by: android.security.KeyStoreException: Signature/MAC verification failed (internal Keystore code: -30 message: system/security/keystore2/src/operation.rs:847: KeystoreOperation::finish

Caused by:
    0: system/security/keystore2/src/operation.rs:428: Finish failed.
    1: Error::Km(r#VERIFICATION_FAILED)) (public error code: 10 internal Keystore code: -30)
	at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:416)
	at android.security.KeyStoreOperation.handleExceptions(KeyStoreOperation.java:79)
	at android.security.KeyStoreOperation.finish(KeyStoreOperation.java:132)
	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer$MainDataStream.finish(KeyStoreCryptoOperationChunkedStreamer.java:228)
	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:181)
	at android.security.keystore2.AndroidKeyStoreAuthenticatedAESCipherSpi$BufferAllOutputUntilDoFinalStreamer.doFinal(AndroidKeyStoreAuthenticatedAESCipherSpi.java:396)
	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:624)
	... 10 more
)PlatformException(AuthError:Unknown, Unexpected authentication error. null, 

[shan-shaji]

Hi @guy-utila , were you able to find a solution for the issue?

[guy-utila]

Hi @guy-utila , were you able to find a solution for the issue?

No. It is a rare case though.

[shan-shaji]

Hi @guy-utila , were you able to find a solution for the issue?

No. It is a rare case though.

Thanks for your reply. Were you able to reproduce this issue in any of the emulators?

[HiddeRpl]

I met the same error with my Motorola Edge 50 Pro. We see in Sentry that some clients of our application have similar issues. I can reproduce situation of "read" in your example app

E/d.c.b.BiometricStoragePlugin( 6046): [pool-5-thread-1     ] Error while calling worker callback. This must not happen.javax.crypto.AEADBadTagException: null
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:632)
E/d.c.b.BiometricStoragePlugin( 6046): 	at javax.crypto.Cipher.doFinal(Cipher.java:2132)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.CryptographyManagerImpl.decryptData(CryptographyManager.kt:135)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStorageFile.readFile(BiometricStorageFile.kt:121)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$3$1.invoke(BiometricStoragePlugin.kt:253)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$3$1.invoke(BiometricStoragePlugin.kt:252)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$withAuth$2.invoke(BiometricStoragePlugin.kt:205)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$withAuth$2.invoke(BiometricStoragePlugin.kt:204)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$authenticate$prompt$1$onAuthenticationSucceeded$$inlined$worker$1.run(BiometricStoragePlugin.kt:461)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:524)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.FutureTask.run(FutureTask.java:317)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1156)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:651)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.lang.Thread.run(Thread.java:1119)
E/d.c.b.BiometricStoragePlugin( 6046): Caused by: android.security.KeyStoreException: Signature/MAC verification failed (internal Keystore code: -30 message: system/security/keystore2/src/operation.rs:852: KeystoreOperation::finish
E/d.c.b.BiometricStoragePlugin( 6046):
E/d.c.b.BiometricStoragePlugin( 6046): Caused by:
E/d.c.b.BiometricStoragePlugin( 6046):     0: system/security/keystore2/src/operation.rs:433: Finish failed for uid 10582
E/d.c.b.BiometricStoragePlugin( 6046):     1: Error::Km(r#VERIFICATION_FAILED))
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:428)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.KeyStoreOperation.handleExceptions(KeyStoreOperation.java:79)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.KeyStoreOperation.finish(KeyStoreOperation.java:132)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer$MainDataStream.finish(KeyStoreCryptoOperationChunkedStreamer.java:228)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:181)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.AndroidKeyStoreAuthenticatedAESCipherSpi$BufferAllOutputUntilDoFinalStreamer.doFinal(AndroidKeyStoreAuthenticatedAESCipherSpi.java:396)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:624)
E/d.c.b.BiometricStoragePlugin( 6046): 	... 13 common frames omitted
E/d.c.b.BiometricStoragePlugin( 6046): [main                ] AuthError: AuthenticationErrorInfo(error=Unknown, message=Unexpected authentication error. null, errorDetails=javax.crypto.AEADBadTagException
E/d.c.b.BiometricStoragePlugin( 6046): javax.crypto.AEADBadTagException
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:632)
E/d.c.b.BiometricStoragePlugin( 6046): 	at javax.crypto.Cipher.doFinal(Cipher.java:2132)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.CryptographyManagerImpl.decryptData(CryptographyManager.kt:135)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStorageFile.readFile(BiometricStorageFile.kt:121)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$3$1.invoke(BiometricStoragePlugin.kt:253)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$3$1.invoke(BiometricStoragePlugin.kt:252)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$withAuth$2.invoke(BiometricStoragePlugin.kt:205)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$withAuth$2.invoke(BiometricStoragePlugin.kt:204)
E/d.c.b.BiometricStoragePlugin( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$authenticate$prompt$1$onAuthenticationSucceeded$$inlined$worker$1.run(BiometricStoragePlugin.kt:461)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:524)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.FutureTask.run(FutureTask.java:317)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1156)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:651)
E/d.c.b.BiometricStoragePlugin( 6046): 	at java.lang.Thread.run(Thread.java:1119)
E/d.c.b.BiometricStoragePlugin( 6046): Caused by: android.security.KeyStoreException: Signature/MAC verification failed (internal Keystore code: -30 message: system/security/keystore2/src/operation.rs:852: KeystoreOperation::finish
E/d.c.b.BiometricStoragePlugin( 6046):
E/d.c.b.BiometricStoragePlugin( 6046): Caused by:
E/d.c.b.BiometricStoragePlugin( 6046):     0: system/security/keystore2/src/operation.rs:433: Finish failed for uid 10582
E/d.c.b.BiometricStoragePlugin( 6046):     1: Error::Km(r#VERIFICATION_FAILED)) (public error code: 10 internal Keystore code: -30)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:428)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.KeyStoreOperation.handleExceptions(KeyStoreOperation.java:79)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.KeyStoreOperation.finish(KeyStoreOperation.java:132)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer$MainDataStream.finish(KeyStoreCryptoOperationChunkedStreamer.java:228)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:181)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.AndroidKeyStoreAuthenticatedAESCipherSpi$BufferAllOutputUntilDoFinalStreamer.doFinal(AndroidKeyStoreAuthenticatedAESCipherSpi.java:396)
E/d.c.b.BiometricStoragePlugin( 6046): 	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:624)
E/d.c.b.BiometricStoragePlugin( 6046): 	... 13 more
E/d.c.b.BiometricStoragePlugin( 6046): )
I/flutter ( 6046): 2025-11-05 12:49:19.714174 FINEST biometric_storage - Error during plugin operation (details: javax.crypto.AEADBadTagException
I/flutter ( 6046): javax.crypto.AEADBadTagException
I/flutter ( 6046): 	at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:632)
I/flutter ( 6046): 	at javax.crypto.Cipher.doFinal(Cipher.java:2132)
I/flutter ( 6046): 	at design.codeux.biometric_storage.CryptographyManagerImpl.decryptData(CryptographyManager.kt:135)
I/flutter ( 6046): 	at design.codeux.biometric_storage.BiometricStorageFile.readFile(BiometricStorageFile.kt:121)
I/flutter ( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$3$1.invoke(BiometricStoragePlugin.kt:253)
I/flutter ( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$3$1.invoke(BiometricStoragePlugin.kt:252)
I/flutter ( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$withAuth$2.invoke(BiometricStoragePlugin.kt:205)
I/flutter ( 6046): 	at design.codeux.biometric_storage.BiometricStoragePlugin$onMethodCall$withAuth$2.invoke(BiometricStoragePlugin.kt:204)
I/flutter ( 6046): 	at design.codeux.biometric_storage
E/flutter ( 6046): [ERROR:flutter/runtime/dart_vm_initializer.cc(40)] Unhandled Exception: AuthException{code: AuthExceptionCode.unknown, message: Unexpected authentication error. null}
E/flutter ( 6046): #0      StandardMethodCodec.decodeEnvelope (package:flutter/src/services/message_codecs.dart:652:7)
E/flutter ( 6046): #1      MethodChannel._invokeMethod (package:flutter/src/services/platform_channel.dart:370:18)
E/flutter ( 6046): <asynchronous suspension>
E/flutter ( 6046): #2      StorageActions.build.<anonymous closure> (package:biometric_storage_example/main.dart:269:30)

[shan-shaji]

Hey @HiddeRpl, on which device were you able to reproduce this issue? I believe the exception originates from this function
. The same function works fine on other devices.

[HiddeRpl]

The device was Motorola Edge 50 Pro (Android 16). Yes, the exception comes from cipher.doFinal in mentioned function

[HiddeRpl]

By debugging your example app i found a core problem. Some of devices declare that they implement strongbox feature, but actually it doesn't mean that they can write/read data with it android facepalm.

            val useStrongBox = context.packageManager.hasSystemFeature(
                PackageManager.FEATURE_STRONGBOX_KEYSTORE
            )
            setIsStrongBoxBacked(useStrongBox)

https://stackoverflow.com/questions/58502299/how-to-check-for-strongbox-keymaster-hardware-availability-before-key-generation#comment140669789_59449662

[HiddeRpl]

I made a fork with a fix to selfcheck writing data and fallbacking to strongbox: false. Self check to work needs androidAuthenticationValidityDuration to set

main...HiddeRpl:biometric_storage:main

[shan-shaji]

Hey @HiddeRpl , Thank you for your findings. So as a workaround if we disable the StrongBox use it should also work right? I couldn't test it as i don't have a device to reproduce the same.

[shan-shaji]

There is already a PR for that #139

[HiddeRpl]

Disabling the Strongbox is the easiest solution, but we didn't want to abandon strongbox for users who can perform at better security level.

[shan-shaji]

Yeah, makes sense. Anyway, it's weird that hasSystemFeature returns true but still doesn’t allow reading or writing data.