SecureException in AesCbcWithIntegrity:installLinuxPRNGSecureRandom about secure-preferences

[cyberrob-zz]

I got the same problem only when I running a apk with minifyEnabled is true:

Caused by: java.lang.SecurityException: new SecureRandom() backed by wrong Provider: class com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes$LinuxPRNGSecureRandomProvider
at com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes.d(Unknown Source)
at com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes.a(Unknown Source)
at com.tozny.crypto.android.AesCbcWithIntegrity.c(Unknown Source)
at com.tozny.crypto.android.AesCbcWithIntegrity.a(Unknown Source)
at com.tozny.crypto.android.AesCbcWithIntegrity.a(Unknown Source)

in the proguard config I add:

-keep class com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes$* { *; }

running on Genymotion Android Emulator 4.2.2

Is this related to tozny/java-aes-crypto#13 or this post ?

[cyberrob-zz]

I've tested all versions from Android 4.1.1, 4.2.2, 4.3 (Genymotion Emulator) They all crashed.

However if change the version of secure-preference from 1.0.3 to 1.0.2，it all worked!

This might not completely solve the problem but it could help for now.

[scottyab]

Thanks Robert, I'll take a look today

On Tue, 13 Oct 2015 07:54 Robert Wang [email protected] wrote:

I've tested all versions from 4.1.1, 4.2.2, 4.3 (Genymotion Emulator) They
all crashed.

However I change the version of secure-preference from 1.0.3 to 1.0.2，it
all worked!

This might not completely solve the problem but it could help for now.

—
Reply to this email directly or view it on GitHub
#31 (comment)
.

[scottyab]

The PrngFixes class is doing several equals checks on class names i.e getProvider().getClass().getSimpleName().equals("LinuxPRNGSecureRandomProvider") but this was failing due to the obfuscation. Even when using -keep on the two inner classes of PrngFixes ( LinuxPRNGSecureRandomProvider and LinuxPRNGSecureRandom) still the equals wasn't satisfied.

I changed the equals check to use LinuxPRNGSecureRandomProvider.class.getSimpleName() rather than "LinuxPRNGSecureRandomProvider". This way it doesn't matter if proguard (or whatever) changes the class name.

Tested on devices and genymotion.

I'll add the fixed the java-aes-crypto lib (my fork) it'll be in version 'com.scottyab:aes-crypto:0.0.4' and I'll PR to the original.

[scottyab]

Fixed in v0.1.4 of Secure-preferences

[fernandospr]

This is not fixed in v0.1.4. Please, reopen. I still see the exception:

Caused by java.lang.SecurityException: new SecureRandom() backed by wrong Provider: class org.apache.harmony.security.provider.crypto.CryptoProvider
       at com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes.installLinuxPRNGSecureRandom(AesCbcWithIntegrity.java:767)

GT-I8190L
Android 4.1.2

[ankitgoyal1009]

I can still see the issue. Interesting thing is it is happening to my users but none of my test devices has this issue.

[0w60]

Still crashes on 4.1.1

Fatal Exception: java.lang.RuntimeException
Unable to create application: java.lang.SecurityException: SecureRandom.getInstance("SHA1PRNG") backed by wrong Provider: class org.apache.harmony.security.provider.crypto.CryptoProvider

[bmacedo]

Is there any solution available for this? I get this crash as well on a Samsung 4.1.2 device.

[gilshallem]

Still happening

Runining this code:
SecurePreferences.Editor prefs = new SecurePreferences(mContext).edit();

Gives this error:

Fatal Exception: java.lang.SecurityException: new SecureRandom() backed by wrong Provider: class org.apache.harmony.security.provider.crypto.CryptoProvider
at com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes.installLinuxPRNGSecureRandom(AesCbcWithIntegrity.java:764)
at com.tozny.crypto.android.AesCbcWithIntegrity$PrngFixes.apply(AesCbcWithIntegrity.java:680)
at com.tozny.crypto.android.AesCbcWithIntegrity.fixPrng(AesCbcWithIntegrity.java:347)
at com.tozny.crypto.android.AesCbcWithIntegrity.generateKeyFromPassword(AesCbcWithIntegrity.java:184)
at com.securepreferences.SecurePreferences.generateAesKeyName(SecurePreferences.java:228)
at com.securepreferences.SecurePreferences.(SecurePreferences.java:149)
at com.securepreferences.SecurePreferences.(SecurePreferences.java:134)
at com.securepreferences.SecurePreferences.(SecurePreferences.java:107)
at com.securepreferences.SecurePreferences.(SecurePreferences.java:82)

Device Info:

API:
com.scottyab:secure-preferences-lib:0.1.7