MuntashirAkon/AppManager · error · CryptoException

Not in RSA or ECC mode

Error message

Not in RSA or ECC mode

What it means

AESCrypto delegates key-wrapping of its AES secret key to RSA or ECC depending on the crypto mode set on the parent context. When getEncryptedAesKey is called, neither MODE_RSA nor MODE_ECC matches the stored parent mode, so the mode is invalid and a CryptoException is thrown.

Source

Thrown at app/src/main/java/io/github/muntashirakon/AppManager/crypto/AESCrypto.java:121

    }

    @NonNull
    private AEADParameters getParams() {
        // We need to generate it dynamically due to MAC size issues
        return new AEADParameters(new KeyParameter(mSecretKey.getEncoded()), mMacSizeBits, mIv);
    }

    @CallSuper
    @NonNull
    protected byte[] getEncryptedAesKey() throws CryptoException {
        if (mParentMode.equals(CryptoUtils.MODE_RSA)) {
            return RSACrypto.encryptAesKey(mSecretKey);
        }
        if (mParentMode.equals(CryptoUtils.MODE_ECC)) {
            return ECCCrypto.encryptAesKey(mSecretKey);
        }
        // Invalid mode
        throw new CryptoException("Not in RSA or ECC mode");
    }

    @WorkerThread
    @Override
    public void encrypt(@NonNull Path[] inputFiles, @NonNull Path[] outputFiles) throws IOException {
        handleFiles(true, inputFiles, outputFiles);
    }

    @Override
    public void encrypt(@NonNull InputStream unencryptedStream, @NonNull OutputStream encryptedStream)
            throws IOException {
        // Init cipher
        GCMModeCipher cipher = GCMBlockCipher.newInstance(AESEngine.newInstance());
        cipher.init(true, getParams());
        // Convert unencrypted stream to encrypted stream
        try (OutputStream cipherOS = new CipherOutputStream(encryptedStream, cipher)) {
            IoUtils.copy(unencryptedStream, cipherOS);
        }

View on GitHub (pinned to 0152f468fc)

Solutions

1. Initialize AESCrypto with a valid parent mode (MODE_RSA or MODE_ECC)
2. Check the options/metadata that set the parent mode and correct it to MODE_RSA or MODE_ECC
3. Ensure the RSA or ECC key pair has been generated (KeyStoreManager) so the intended mode can actually be used

Example fix

// before
AESCrypto crypto = new AESCrypto(options); // options has no/invalid mode
crypto.encrypt(inputs, outputs);
// after
options.setMode(CryptoUtils.MODE_RSA); // or MODE_ECC
AESCrypto crypto = new AESCrypto(options);
crypto.encrypt(inputs, outputs);

int mode = cryptoOptions.getMode();
if (mode != CryptoUtils.MODE_RSA && mode != CryptoUtils.MODE_ECC) {
    throw new IllegalArgumentException("AESCrypto requires MODE_RSA or MODE_ECC, got " + mode);
}

try { crypto.encrypt(in, out); } catch (CryptoException e) {
    if (e.getMessage().contains("Not in RSA or ECC mode")) {
        // re-initialize crypto with a valid mode and retry
    }
}

When it happens

Trigger: Calling encrypt/encryptAesKey (or any AESCrypto operation that needs to wrap the AES key) when mParentMode is something other than CryptoUtils.MODE_RSA or CryptoUtils.MODE_ECC — typically MODE_NONE, MODE_DEFAULT, or an uninitialized value.

Common situations: Using AESCrypto without first calling setMode/initializing with a proper parent crypto (e.g. constructing AESCrypto bare instead of via CryptoUtils with an RSA/ECC mode); a corrupted or hand-edited crypto options bundle carrying an unknown mode value; restoring data whose metadata names a mode the code path doesn't support.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Failed to setup metadata.
• No SecretKey with alias ${AES_KEY_ALIAS}
• No KeyPair with alias ${ECC_KEY_ALIAS}
• No KeyPair with alias ${RSA_KEY_ALIAS}
• No KeyPair with alias RSA_KEY_ALIAS

AI-assisted analysis of MuntashirAkon/AppManager@0152f468fc (2026-09-12). Data as JSON: /api/errors/ee4c0501b7891f36. Report an issue: GitHub.