{"record":{"id":"ee4c0501b7891f36","repo":"MuntashirAkon/AppManager","slug":"not-in-rsa-or-ecc-mode","errorCode":null,"errorMessage":"Not in RSA or ECC mode","messagePattern":"Not in RSA or ECC mode","errorType":"exception","errorClass":"CryptoException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/github/muntashirakon/AppManager/crypto/AESCrypto.java","lineNumber":121,"sourceCode":"    }\n\n    @NonNull\n    private AEADParameters getParams() {\n        // We need to generate it dynamically due to MAC size issues\n        return new AEADParameters(new KeyParameter(mSecretKey.getEncoded()), mMacSizeBits, mIv);\n    }\n\n    @CallSuper\n    @NonNull\n    protected byte[] getEncryptedAesKey() throws CryptoException {\n        if (mParentMode.equals(CryptoUtils.MODE_RSA)) {\n            return RSACrypto.encryptAesKey(mSecretKey);\n        }\n        if (mParentMode.equals(CryptoUtils.MODE_ECC)) {\n            return ECCCrypto.encryptAesKey(mSecretKey);\n        }\n        // Invalid mode\n        throw new CryptoException(\"Not in RSA or ECC mode\");\n    }\n\n    @WorkerThread\n    @Override\n    public void encrypt(@NonNull Path[] inputFiles, @NonNull Path[] outputFiles) throws IOException {\n        handleFiles(true, inputFiles, outputFiles);\n    }\n\n    @Override\n    public void encrypt(@NonNull InputStream unencryptedStream, @NonNull OutputStream encryptedStream)\n            throws IOException {\n        // Init cipher\n        GCMModeCipher cipher = GCMBlockCipher.newInstance(AESEngine.newInstance());\n        cipher.init(true, getParams());\n        // Convert unencrypted stream to encrypted stream\n        try (OutputStream cipherOS = new CipherOutputStream(encryptedStream, cipher)) {\n            IoUtils.copy(unencryptedStream, cipherOS);\n        }","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/io/github/muntashirakon/AppManager/crypto/AESCrypto.java#L103-L139","documentation":"AESCrypto delegates key-wrapping of its AES secret key to RSA or ECC depending on the crypto mode set on the parent context. When getEncryptedAesKey is called, neither MODE_RSA nor MODE_ECC matches the stored parent mode, so the mode is invalid and a CryptoException is thrown.","triggerScenarios":"Calling encrypt/encryptAesKey (or any AESCrypto operation that needs to wrap the AES key) when mParentMode is something other than CryptoUtils.MODE_RSA or CryptoUtils.MODE_ECC — typically MODE_NONE, MODE_DEFAULT, or an uninitialized value.","commonSituations":"Using AESCrypto without first calling setMode/initializing with a proper parent crypto (e.g. constructing AESCrypto bare instead of via CryptoUtils with an RSA/ECC mode); a corrupted or hand-edited crypto options bundle carrying an unknown mode value; restoring data whose metadata names a mode the code path doesn't support.","solutions":["Initialize AESCrypto with a valid parent mode (MODE_RSA or MODE_ECC)","Check the options/metadata that set the parent mode and correct it to MODE_RSA or MODE_ECC","Ensure the RSA or ECC key pair has been generated (KeyStoreManager) so the intended mode can actually be used"],"exampleFix":"// before\nAESCrypto crypto = new AESCrypto(options); // options has no/invalid mode\ncrypto.encrypt(inputs, outputs);\n// after\noptions.setMode(CryptoUtils.MODE_RSA); // or MODE_ECC\nAESCrypto crypto = new AESCrypto(options);\ncrypto.encrypt(inputs, outputs);","handlingStrategy":"validation","validationCode":"int mode = cryptoOptions.getMode();\nif (mode != CryptoUtils.MODE_RSA && mode != CryptoUtils.MODE_ECC) {\n    throw new IllegalArgumentException(\"AESCrypto requires MODE_RSA or MODE_ECC, got \" + mode);\n}","typeGuard":null,"tryCatchPattern":"try { crypto.encrypt(in, out); } catch (CryptoException e) {\n    if (e.getMessage().contains(\"Not in RSA or ECC mode\")) {\n        // re-initialize crypto with a valid mode and retry\n    }\n}","preventionTips":["Always create AESCrypto through CryptoUtils with an explicit RSA/ECC mode","Validate options bundle mode before constructing the crypto object","Log the parent mode at init time to catch invalid values early"],"tags":["crypto","android","keystore","invalid-mode"],"backgroundTag":"invalid-enum-value","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}