{"record":{"id":"51dcc5571bbefb0d","repo":"beemdevelopment/Aegis","slug":"unexpected-master-key-cipher-s","errorCode":null,"errorMessage":"Unexpected master key cipher: %s","messagePattern":"Unexpected master key cipher: (.+?)","errorType":"exception","errorClass":"DatabaseImporterException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/com/beemdevelopment/aegis/importers/FreeOtpImporter.java","lineNumber":139,"sourceCode":"        private final byte[] _mkCipherText;\n        private final byte[] _mkParameters;\n        private final byte[] _mkToken;\n        private final byte[] _mkSalt;\n        private final int _mkIterations;\n        private final Map<String, String> _entries;\n\n        private EncryptedState(JSONObject mkObj, Map<String, String> entries)\n                throws DatabaseImporterException, JSONException {\n            super(true);\n\n            _mkAlgo = mkObj.getString(\"mAlgorithm\");\n            if (!_mkAlgo.equals(\"PBKDF2withHmacSHA1\") && !_mkAlgo.equals(\"PBKDF2withHmacSHA512\")) {\n                throw new DatabaseImporterException(String.format(\"Unexpected master key KDF: %s\", _mkAlgo));\n            }\n            JSONObject keyObj = mkObj.getJSONObject(\"mEncryptedKey\");\n            _mkCipher = keyObj.getString(\"mCipher\");\n            if (!_mkCipher.equals(\"AES/GCM/NoPadding\")) {\n                throw new DatabaseImporterException(String.format(\"Unexpected master key cipher: %s\", _mkCipher));\n            }\n            _mkCipherText = toBytes(keyObj.getJSONArray(\"mCipherText\"));\n            _mkParameters = toBytes(keyObj.getJSONArray(\"mParameters\"));\n            _mkToken = keyObj.getString(\"mToken\").getBytes(StandardCharsets.UTF_8);\n            _mkSalt = toBytes(mkObj.getJSONArray(\"mSalt\"));\n            _mkIterations = mkObj.getInt(\"mIterations\");\n            _entries = entries;\n        }\n\n        public State decrypt(char[] password) throws DatabaseImporterException {\n            PBKDFTask.Params params = new PBKDFTask.Params(_mkAlgo, MASTER_KEY_SIZE, password, _mkSalt, _mkIterations);\n            SecretKey passKey = PBKDFTask.deriveKey(params);\n            return decrypt(passKey);\n        }\n\n        public State decrypt(SecretKey passKey) throws DatabaseImporterException {\n            byte[] masterKeyBytes;\n            try {","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/beemdevelopment/Aegis/blob/d6f4e5925a97e4e91593f1542085eae03432a759/app/src/main/java/com/beemdevelopment/aegis/importers/FreeOtpImporter.java#L121-L157","documentation":"FreeOTP's master key must be encrypted with AES/GCM/NoPadding. The importer reads \"mCipher\" from the backup's master key JSON object and throws DatabaseImporterException if it is any other cipher transformation, since Aegis only implements GCM unwrapping for FreeOTP imports.","triggerScenarios":"Importing a FreeOTP backup whose mEncryptedKey.mCipher is not \"AES/GCM/NoPadding\" — e.g. from a modified FreeOTP build or an edited JSON file.","commonSituations":"FreeOTP fork changing cipher mode (e.g. CBC); manual JSON edits; importing a backup from an unrelated app that reuses the FreeOTP schema.","solutions":["Update Aegis to a version supporting the new cipher, or re-export from stock FreeOTP","Inspect mEncryptedKey.mCipher in the JSON to see what was actually used","If the file was hand-edited, restore the original cipher string","Re-create tokens in FreeOTP (stock build) and export again"],"exampleFix":"// before\nif (!_mkCipher.equals(\"AES/GCM/NoPadding\")) {\n    throw new DatabaseImporterException(String.format(\"Unexpected master key cipher: %s\", _mkCipher));\n}\n// after\nif (!_mkCipher.equals(\"AES/GCM/NoPadding\")) {\n    throw new DatabaseImporterException(String.format(\n        \"Unexpected master key cipher: %s (only AES/GCM/NoPadding is supported)\", _mkCipher));\n}","handlingStrategy":"validation","validationCode":"String cipher = backupJson.getJSONObject(\"mMasterKey\")\n        .getJSONObject(\"mEncryptedKey\").getString(\"mCipher\");\nif (!cipher.equals(\"AES/GCM/NoPadding\")) {\n    throw new IllegalArgumentException(\"Unsupported master key cipher: \" + cipher);\n}","typeGuard":null,"tryCatchPattern":"try {\n    importer.read(stream);\n} catch (DatabaseImporterException e) {\n    if (e.getMessage().startsWith(\"Unexpected master key cipher\")) {\n        showUserError(\"Backup master key is not AES/GCM — re-export with stock FreeOTP\");\n    }\n}","preventionTips":["Re-export from unmodified FreeOTP if ciphers differ","Verify mEncryptedKey.mCipher before import","Avoid forks/patches that change crypto primitives"],"tags":["import","freeotp","aes-gcm","crypto"],"backgroundTag":"unsupported-enum-value","analyzedSha":"d6f4e5925a97e4e91593f1542085eae03432a759","analyzedAt":"2026-09-08T00:46:31.111Z","contentChangedAt":"2026-09-08T00:46:31.111Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}