{"record":{"id":"3db87994b5d3f205","repo":"MuntashirAkon/AppManager","slug":"no-secretkey-with-alias-aes-key-alias","errorCode":null,"errorMessage":"No SecretKey with alias ${AES_KEY_ALIAS}","messagePattern":"No SecretKey with alias (.+?)","errorType":"exception","errorClass":"CryptoException","httpStatus":null,"severity":"critical","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/crypto/AESCrypto.java","lineNumber":68,"sourceCode":"    }\n\n    @NonNull\n    @Override\n    public String getModeName() {\n        return mParentMode;\n    }\n\n    protected AESCrypto(@NonNull byte[] iv, @NonNull @CryptoUtils.Mode String mode, @Nullable byte[] encryptedAesKey)\n            throws CryptoException {\n        mIv = iv;\n        mParentMode = mode;\n        switch (mParentMode) {\n            case CryptoUtils.MODE_AES:\n                try {\n                    KeyStoreManager keyStoreManager = KeyStoreManager.getInstance();\n                    mSecretKey = keyStoreManager.getSecretKey(AES_KEY_ALIAS);\n                    if (mSecretKey == null) {\n                        throw new CryptoException(\"No SecretKey with alias \" + AES_KEY_ALIAS);\n                    }\n                } catch (Exception e) {\n                    throw new CryptoException(e);\n                }\n                break;\n            case CryptoUtils.MODE_RSA:\n                // Hybrid encryption using RSA\n                if (encryptedAesKey == null) {\n                    // No encryption key provided, generate one\n                    mSecretKey = RSACrypto.generateAesKey();\n                } else {\n                    // Encryption key provided\n                    mSecretKey = RSACrypto.decryptAesKey(encryptedAesKey);\n                }\n                break;\n            case CryptoUtils.MODE_ECC:\n                // Hybrid encryption using ECC\n                if (encryptedAesKey == null) {","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/crypto/AESCrypto.java#L50-L86","documentation":"AESCrypto's constructor throws this CryptoException in MODE_AES when KeyStoreManager.getSecretKey(AES_KEY_ALIAS) returns null — i.e. the Android keystore has no key under the AES_KEY_ALIAS name. Without that SecretKey, AES-based encrypt/decrypt cannot proceed.","triggerScenarios":"Constructing AESCrypto with CryptoUtils.MODE_AES before any key was ever generated under AES_KEY_ALIAS, after app data/keystore wipe (factory reset, clearing app storage), or on a device where keystore key generation silently failed.","commonSituations":"Restore-from-backup onto a new device where the keystore-backed key was not migrated (keystore keys are non-exportable); users clearing app data; ROM changes invalidating StrongBox/TEE keys.","solutions":["Generate the key first via KeyStoreManager (ensure a key-generation step runs before AESCrypto is constructed)","Detect the missing key and re-encrypt user data with a freshly generated key, or inform the user data is unrecoverable","Pin/salt AES_KEY_ALIAS handling: never assume key persistence across devices or data clears","Wrap construction in try-catch for CryptoException and route to key-setup flow"],"exampleFix":"// before\nmSecretKey = keyStoreManager.getSecretKey(AES_KEY_ALIAS);\nif (mSecretKey == null) throw new CryptoException(\"No SecretKey with alias \" + AES_KEY_ALIAS);\n// after\nSecretKey key = keyStoreManager.getSecretKey(AES_KEY_ALIAS);\nif (key == null) {\n    key = keyStoreManager.generateAesKey(AES_KEY_ALIAS); // create before use\n}\nmSecretKey = key;","handlingStrategy":"try-catch","validationCode":"KeyStoreManager ksm = KeyStoreManager.getInstance();\nif (ksm.getSecretKey(AES_KEY_ALIAS) == null) {\n    ksm.generateKey(AES_KEY_ALIAS); // provision before use\n}","typeGuard":"boolean hasAesKey() {\n    try {\n        return KeyStoreManager.getInstance().getSecretKey(AES_KEY_ALIAS) != null;\n    } catch (Exception e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    crypto = new AESCrypto(CryptoUtils.MODE_AES);\n} catch (CryptoException e) {\n    Log.e(TAG, \"AES key missing; prompting re-setup\", e);\n    startKeySetupOrDataResetFlow();\n}","preventionTips":["Generate keys eagerly at first run","Never assume keystore keys survive device restore or data clear","Design a graceful data-reset path for unrecoverable keys","Wrap key access with existence checks"],"tags":["android","keystore","crypto","missing-key"],"backgroundTag":"missing-credentials","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}