getGenericPassword failing after updating package from 8.2.0

[Bowlerr]

Title: Incompatibility Between Versions 8.2.0 and 9.2.2 with getGenericPassword

Description:
When upgrading from react-native-keychain version 8.2.0 to 9.2.2/9.2.1, I encountered an error when calling getGenericPassword. The password was set using version 8.2.0, but when attempting to retrieve it in version 9.2.2, the following error occurs:

Wrapped error: The message could not be decrypted successfully. It has either been tampered with or the wrong resource is being decrypted.

Steps to Reproduce:

1. Set the password using version 8.2.0:

   setGenericPassword('pin', encrypted, {
     service: 'passcode',
     storage: STORAGE_TYPE.FB,
   });

2. Upgrade to version 9.2.2 or 9.2.1:
3. Attempt to retrieve the password using:

   await getGenericPassword({ service: 'passcode' });

Observed Behavior:
The getGenericPassword call fails with the error:

Wrapped error: The message could not be decrypted successfully. It has either been tampered with or the wrong resource is being decrypted.

Expected Behavior:
The getGenericPassword call should successfully retrieve the password set in version 8.2.0.

Environment:

• Devices Tested:
  • OnePlus 12 (Android 14)
  • Pixel 7a (Android 15)
• React Native Keychain Version:
  • Set: 8.2.0
  • Retrieve: 9.2.2
• React Native Version: 0.74.5

Additional Notes:
It seems like the encryption format or decryption logic may have changed between the two versions, resulting in backward compatibility issues. If this is expected, could you provide guidance on migrating securely without data loss?

[DorianMazur]

Hi! I’ll take a look at this soon. Just one quick question: is there a specific reason you’re still using FacebookConceal? It’s outdated and will be removed soon. Are other ciphers affected as well?

[Bowlerr]

Hi! I’ll take a look at this soon. Just one quick question: is there a specific reason you’re still using FacebookConceal? It’s outdated and will be removed soon. Are other ciphers affected as well?

@DorianMazur I found this issue whilst upgrading from FacebookConceal to AES_GCM_NO_AUTH or AES_GCM depending on if the user wants to use biometrics.

I thought the issue at first was the migration to these storage types but ended up finding the issue was with the upgrading of the package.

[Bowlerr]

I can check on the other ciphers we use. Currently it is KC which is also being migrated once we can sort this upgrade issue. I haven't had a chance to test this yet but can do today

[Bowlerr]

So the other storage we used was KC which migrates over to AES_GCM_NO_AUTH without any issues. @DorianMazur

[Bowlerr]

@DorianMazur hey, hope you've had a wonderful new year and holidays, I was wondering if there's any progress/updates on this ?

[DorianMazur]

@Bowlerr I will be working on it this weekend.

[DorianMazur]

Hi @Bowlerr,

I looked into this, but it’s quite difficult to investigate. It seems like the issue is related to FacebookConceal, which hasn’t been maintained for a few years now.

To fix this, I recommend switching to AES encryption in the version 8.2.0 of react-native-keychain. You can use the following code to safely migrate your data from FB to AES:

await getGenericPassword({ service: 'passcode', rules: SECURITY_RULES.AUTOMATIC_UPGRADE });

After that, you can update to version 9.2.2. Please note that FacebookConceal will be removed in the next major release of react-native-keychain.

Hope this helps!

[Bowlerr]

@DorianMazur
Hey, thank you for taking the time to look into this.

I have thought of that solution however I can't guarantee all our active users will upgrade the app in order and at the moment we do not have OTA updates in place.

The best bet I can think of is to hold off on updating after moving away from FC after a few app updates until an acceptable amount of users have converted.

If you have any other suggestions or luck figuring out a solution let me know

[Bowlerr]

@DorianMazur I managed to figure out the issue. Ended up being an extra space being added in the conversion of the code to Kotlin... It works perfectly after.