From 0b67700763c0ef046c9d668a037808c83014afbc Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Wed, 17 Jun 2026 14:54:22 +0100 Subject: [PATCH] fix(keystore): evict stale cached key on regen keystore2 replaces a key when generateKey reuses an alias. Mirror that: drop any cached chain for the alias so a later getKeyEntry serves the current key, not a stale FORGE from a prior generation (an attest-key-mode leaf cached, then re-generated without an attest key). --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 8c67793..7c4204f 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -704,6 +704,12 @@ class KeyMintSecurityLevelInterceptor( val keyId = KeyIdentifier(callingUid, keyDescriptor.alias) + // keystore2 generateKey replaces an existing alias; drop any cached chain from a + // prior generation on it so a later getKeyEntry serves THIS key, never a stale + // FORGE (an attest-key-mode leaf cached, then re-generated without an attest key, + // otherwise resurfaces and breaks the app's reassembled chain). + if (generatedKeys.containsKey(keyId)) cleanupKeyData(keyId) + // Device-ID attestation must be forged, not patched: the real TEE returns // CANNOT_ATTEST_IDS, so there is no real chain to patch — only a synthetic one // carrying the requested IDs and rooted under the keybox will satisfy the caller.