From 25dbddf73396e61e842ee04e41a1e458a4fa62a2 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Sun, 22 Mar 2026 00:42:48 +0100 Subject: [PATCH] fix(interception): reject EC+DECRYPT in createOperation EC keys don't support DECRYPT (only AGREE_KEY for key derivation). Without this guard, an EC DECRYPT operation creates a CipherPrimitive that fails with a confusing JCA error instead of returning UNSUPPORTED_PURPOSE upfront. --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index c25c079..0c5b975 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -328,7 +328,8 @@ class KeyMintSecurityLevelInterceptor( (isAsymmetric && (requestedPurpose == KeyPurpose.VERIFY || requestedPurpose == KeyPurpose.ENCRYPT)) || - (requestedPurpose == KeyPurpose.AGREE_KEY && algorithm != Algorithm.EC) + (requestedPurpose == KeyPurpose.AGREE_KEY && algorithm != Algorithm.EC) || + (algorithm == Algorithm.EC && requestedPurpose == KeyPurpose.DECRYPT) if (unsupported) { return InterceptorUtils.createServiceSpecificErrorReply( KeystoreErrorCode.UNSUPPORTED_PURPOSE