search

mjwheatley / cordova-plugin-android-fingerprint-auth

A cordova plugin for fingerprint authentication using the hardware fingerprint scanner on devices running Android 6+
Apache License 2.0
169 stars 131 forks source link

Fatal Exception: java.lang.IllegalStateException: IV has already been used. Reusing IV in encryption mode violates security best practices. #143

Open ozamamurzleen opened 4 years ago

ozamamurzleen commented 4 years ago

Hello Sir,

I have used your plugin and recently it appeared to be this exception occurring on samsung devices:

Fatal Exception: java.lang.IllegalStateException: IV has already been used. Reusing IV in encryption mode violates security best practices. at android.security.keystore.AndroidKeyStoreUnauthenticatedAESCipherSpi.addAlgorithmSpecificParametersToBegin + 244(AndroidKeyStoreUnauthenticatedAESCipherSpi.java:244) at android.security.keystore.AndroidKeyStoreCipherSpiBase.ensureKeystoreOperationInitialized + 237(AndroidKeyStoreCipherSpiBase.java:237) at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal + 495(AndroidKeyStoreCipherSpiBase.java:495) at javax.crypto.Cipher.doFinal + 2055(Cipher.java:2055) at com.cordova.plugin.android.fingerprintauth.FingerprintAuth.onAuthenticated + 636(FingerprintAuth.java:636) at com.cordova.plugin.android.fingerprintauth.FingerprintAuthenticationDialogFragment.onAuthenticated + 259(FingerprintAuthenticationDialogFragment.java:259) at com.cordova.plugin.android.fingerprintauth.FingerprintUiHelper$3.run + 167(FingerprintUiHelper.java:167) at android.os.Handler.handleCallback + 873(Handler.java:873) at android.os.Handler.dispatchMessage + 99(Handler.java:99) at android.os.Looper.loop + 214(Looper.java:214) at android.app.ActivityThread.main + 7032(ActivityThread.java:7032) at java.lang.reflect.Method.invoke(Method.java) at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run + 494(RuntimeInit.java:494) at com.android.internal.os.ZygoteInit.main + 965(ZygoteInit.java:965)

Samsung s10 Android 9

It says it crashed on 636 line at FingerprintAuth.java which is: cryptoObject.getCipher().doFinal(mClientSecret.getBytes("UTF-8")); //this line is at 636