AndroidKeyStore KeyPairGenerator crashes from a small number of devices

Question

My application is for Android 6.0+ only. In my application, I generate an RSA key in AndroidKeyStore with the following:

 KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA", "AndroidKeyStore"); kpg.initialize(new KeyGenParameterSpec.Builder( "myKey", KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT) .setCertificateSubject(new X500Principal("CN=myKey")) .setDigests("SHA-1") .setEncryptionPaddings("OAEPPadding") .build()); KeyPair kp = kpg.generateKeyPair(); 

This works well on the 20+ devices we tested, and almost 100% of our users.

However, there are a small number of users this application works with when kpg.generateKeyPair() is kpg.generateKeyPair() with the following:

 java.security.ProviderException: Failed to load generated key pair from keystore at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:518) at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:470) at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:699) at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.n_onCreate(Native Method) at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.onCreate(MainApplication.java:34) at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1025) at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5448) at android.app.ActivityThread.-wrap2(ActivityThread.java) at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564) at android.os.Handler.dispatchMessage(Handler.java:102) at android.os.Looper.loop(Looper.java:154) at android.app.ActivityThread.main(ActivityThread.java:6186) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779) Caused by: java.security.UnrecoverableKeyException: Failed to obtain X.509 form of public key at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:230) at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:259) at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:509) ... 14 more Caused by: android.security.KeyStoreException: -22 at android.security.KeyStore.getKeyStoreException(KeyStore.java:676) at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:231) ... 16 more java.security.UnrecoverableKeyException: Failed to obtain X.509 form of public key at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:230) at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:259) at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:509) at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:470) at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:699) at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.n_onCreate(Native Method) at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.onCreate(MainApplication.java:34) at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1025) at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5448) at android.app.ActivityThread.-wrap2(ActivityThread.java) at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564) at android.os.Handler.dispatchMessage(Handler.java:102) at android.os.Looper.loop(Looper.java:154) at android.app.ActivityThread.main(ActivityThread.java:6186) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779) Caused by: android.security.KeyStoreException: -22 at android.security.KeyStore.getKeyStoreException(KeyStore.java:676) at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:231) ... 16 more android.security.KeyStoreException: -22 at android.security.KeyStore.getKeyStoreException(KeyStore.java:676) at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:231) at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:259) at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.loadKeystoreKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:509) at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:470) at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:699) at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.n_onCreate(Native Method) at md5fb78b69c5ddbc157f4db38fd738139a6.MainApplication.onCreate(MainApplication.java:34) at android.app.Instrumentation.callApplicationOnCreate(Instrumentation.java:1025) at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5448) at android.app.ActivityThread.-wrap2(ActivityThread.java) at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564) at android.os.Handler.dispatchMessage(Handler.java:102) at android.os.Looper.loop(Looper.java:154) at android.app.ActivityThread.main(ActivityThread.java:6186) at java.lang.reflect.Method.invoke(Native Method) at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889) at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779) 

The only thing I can find on the Internet about this error, Failed to obtain X.509 form of public key , is a few articles without real solutions. Cm:

• https://github.com/AzureAD/azure-activedirectory-library-for-android/issues/740
• https://jira.lineageos.org/browse/BUGBASH-454

A few reports that we received from users with OnePlus devices on Android 7.1, which is also one of the devices mentioned in the above articles, but, of course, there are other devices.

• Why is this happening?
• Are there any workarounds?