Android keystore fails with error code -26 (fingerprint unlock)

[efelon]

Describe the bug

When trying to unlock the KeePass database using the biometric unlock (fingerprint) I always get the error -26 (details in the logcat) on a fresh install of lineage OS. Using only the password or the "normal" device unlock code works fine. First I thought to file a bug with LineageOS, but unlocking the Nextcloud App with the fingerprint is working fine. I used the "same" setup on other Motorola phones now and before which was always working well. The most obvious difference I can see between the Moto G7 plus (which is working well) and the new Moto g32 (which fails) is the Kernel version while both are using LineageOS 20:

• Kernel-Version g32 (unlock error): 4.19.304-perf+
• Kernel-Version g7 plus (working): 4.4.302-perf+

I already tried (with always the same error):

• Install from Playstore
• Manually delete encryption keys
• Add/remove additional fingerprints to the system

Logcat keestore_logcat.txt

To Reproduce

Steps to reproduce the behavior:

1. Configure Biometric Unlock
2. Select you database and enter password
3. Press on "unlock with biometrics"
4. See error

Expected behavior

No error and the database to be unlocked.

KeePass Database

• Created with: Windows KeePass (cannot remember the version)
• Version: 2 (KDBX 4)
• Location: File System
• File provider -
• Size: 228kB
• Contains attachment: Yes

KeePassDX:

• Version: 4.0.5
• Build: F-Droid
• Language: German

Android:

• Device: Motorola Moto g32
• Version: 13 (LineageOS20-20240127-NIGHTLY-devon)
• Kernel-Version: 4.19.304-perf+

Additional context

Add any other context about the problem here.

• Maybe related bug: https://issuetracker.google.com/issues/293722051

[J-Jamet]

This is a known Lineage bug: the Keystore is no longer certified, so it is no longer possible to store secure symmetrical keys in it. Your Nextcloud App is a client-server application which does not use biometric recognition in the same way. Duplicate https://github.com/Kunzisoft/KeePassDX/issues/215 You can use device unlocking, which is more permissive.

[efelon]

Thanks @J-Jamet. For everyone who is wondering about this, with the update to LineageOS 21 the problem is solved.