Skip to content

[Android] v10 Migrator fails to decrypt v9 data saved with AES_GCM_NoPadding #1079

@mateuszniewiadomski

Description

@mateuszniewiadomski

Description

I updated flutter_secure_storage from version 9.2.4 to 10.0.0+. After the update, the app crashes completely on Android. The migration process fails to read the old data, which results in a NullPointerException when the app tries to access the storage. I successfully reproduced this issue using your official example app.

To Reproduce

Steps to reproduce the behavior using the example app:

  1. Run the example app using flutter_secure_storage: ^9.2.4.
  2. Add these exact AndroidOptions:
AndroidOptions(
  keyCipherAlgorithm: KeyCipherAlgorithm.RSA_ECB_OAEPwithSHA_256andMGF1Padding,
  storageCipherAlgorithm: StorageCipherAlgorithm.AES_GCM_NoPadding,
  resetOnError: false,
)
  1. Save some data in the app and close it.
  2. Upgrade the dependency to flutter_secure_storage: ^10.0.0.
  3. Run the app again.
  4. The app crashes during migration with IllegalBlockSizeException followed by NullPointerException.

Expected behavior

The library should migrate the data successfully without crashing the application. Using the resetOnError: true flag is not an acceptable workaround for my use case, because the encrypted data in my application is critical for its correct operation and simply cannot be lost or automatically deleted.

Device & Environment

  • Samsung Galaxy S23+
  • Android 16 (Rooted: No)
  • Flutter Version: 3.38.7

Logs

2026-03-23 12:29:51.152 E Failed to decrypt key: VGhpcyBpcyB0aGUgcHJlZml4IGZvciBhIHNlY3VyZSBzdG9yYWdlCg_1774265231633266
javax.crypto.IllegalBlockSizeException: error:1e00007b:Cipher functions:OPENSSL_internal:WRONG_FINAL_BLOCK_LENGTH
	at com.android.org.conscrypt.NativeCrypto.EVP_CipherFinal_ex(Native Method)
	at javax.crypto.Cipher.doFinal(Cipher.java:2074)
	at com.it_nomads.fluttersecurestorage.ciphers.StorageCipherImplementationAES18.decrypt(StorageCipherImplementationAES18.java:91)
	at com.it_nomads.fluttersecurestorage.FlutterSecureStorage.decryptAllWithSavedCipher(FlutterSecureStorage.java:383)

[...]
java.lang.NullPointerException: Attempt to invoke interface method 'byte[] com.it_nomads.fluttersecurestorage.ciphers.StorageCipher.decrypt(byte[])' on a null object reference

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions