bug: Android Biometric (OnePlus, Galaxy) Devices Error in KeyStore Encryption

[AdlerJS]

Bug Report

Capacitor Version

Latest Dependencies:

  @capacitor/cli: 5.4.1
  @capacitor/core: 5.4.1
  @capacitor/android: 5.4.1
  @capacitor/ios: 5.4.1

Installed Dependencies:

  @capacitor/cli: 5.2.3
  @capacitor/core: 5.2.2
  @capacitor/android: 5.2.2
  @capacitor/ios: 5.2.2

Plugin Version

 Installed Dependencies:

   @capgo/cli: 3.13.31
   @capgo/capacitor-native-biometric: 5.1.0


✓ Latest Dependencies:


   @capgo/cli: 3.13.31
   @capgo/capacitor-native-biometric: 5.1.0

Platform(s)

• Android Devices (So far have tracked OnePlus & Galaxy)
• Pixel Devices seem to work (note: mine has touchID while the others use faceId)

Current Behavior

SetCredentials does not work and Android Errors:

       await NativeBiometric.deleteCredentials({
                  server: BIOMETRIC_SERVER,
                });
                await NativeBiometric.setCredentials({
                  username: mobileNumber,
                  password: 'password',
                  server: BIOMETRIC_SERVER,
                });

Results In: "Failed to Set Credentials" being thrown

Expected Behavior

Biometrics should work and credentials should be set

Code Reproduction

            Calling Simply doing this on certain devices such as a OnePlus7 results in the following being logged to logcat & the error reported above being sent to JS error object:

       await NativeBiometric.deleteCredentials({
                  server: BIOMETRIC_SERVER,
                });
                await NativeBiometric.setCredentials({
                  username: mobileNumber,
                  password: 'password',
                  server: BIOMETRIC_SERVER,
                });

                2023-09-22 13:49:17.374 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.566 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.582 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.665 804-24181/? E/keystore2: keystore2::gc: Error trying to delete blob entry. In process_one_key: Trying to unwrap to-be-deleted blob.
    
    Caused by:
        0: In unwrap_key: Required super decryption key is not in memory.
        1: Error::Rc(ResponseCode(2))
2023-09-22 13:49:17.668 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.681 804-20811/? E/keystore2: keystore2::error: In get_security_level: No such security level.
    
    Caused by:
        Error::Km(ErrorCode(-68))
2023-09-22 13:49:17.685 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.698 804-818/? E/keystore2: keystore2::error: In create_operation. Failed to handle super encryption.
    
    Caused by:
        0: In unwrap_key: Required super decryption key is not in memory.
        1: Error::Rc(ResponseCode(2))
2023-09-22 13:49:17.702 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.711 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.719 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.727 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied
2023-09-22 13:49:17.735 1484-1484/? E/SchedAssist: ofbSetSfMsgTrans pid(1484) failed with error=Permission denied

Other Technical Details

npm --version output: 8.19.2

node --version output: v16.18.1

pod --version output (iOS issues only): N/A

Additional Context

[riderx]

/bounty 30

[algora-pbc]

💎 $30 bounty created by riderx
🙋 If you start working on this, comment /attempt #7 to notify everyone
👉 To claim this bounty, submit a pull request that includes the text /claim #7 somewhere in its body
📝 Before proceeding, please make sure you can receive payouts in your country
💵 Payment arrives in your account 2-5 days after the bounty is rewarded
💯 You keep 100% of the bounty award
ℹ️ If something is not clear ask before working on it, otherwise your chance to rework it is high
👨‍👩‍👧‍👦 Join the Discord to get help
📏 Check all Bounty rules
🙏 Thank you for contributing to Cap-go/capacitor-native-biometric!

[riderx]

It’s seems on the original plugin someone made something for this issue:
It seems very similar / related to what this person was facing:

epicshaggy#103

[AdlerJS]

Closing issue in favor of - #8

[kito99]

@danbunkr how is this similar to #8? The root cause of this is related to the shared preferences, or more specifically, the encryption used with shared preferences.