Async loading on recyclerview viewholder not working properly

Issue

I'm developing an app that shows sensible information so I have to encrypt all informations stored on Room Database. After a lot of research, I choosed to encypt using AES, generating a random key and storing on KeyStore (minSdk: 24 btw).

private fun encript(plain: String): String? {
    return try {
        generateKey()
        encData(plain)
    } catch (e: Throwable) {
        if (!BuildConfig.DEBUG){
            Crashlytics.logException(e)
        }
        null
    }
}

private fun encData(plain: String): String? {
    val sKey = getSecretKey()
    iv = ByteArray(12)
    secRng = SecureRandom()
    secRng.nextBytes(iv)
    val cipher = Cipher.getInstance(AES_MODE)
    val parameterSpec = GCMParameterSpec(128, iv)
    cipher.init(Cipher.ENCRYPT_MODE, sKey, parameterSpec)
    cipText = cipher.doFinal(plain.toByteArray())
    return encBuffer()
}

private fun encBuffer(): String? {
    val byteBuffer = ByteBuffer.allocate(4 + iv.size + cipText.size)
    byteBuffer.putInt(iv.size)
    byteBuffer.put(iv)
    byteBuffer.put(cipText)
    val cipherMessage = byteBuffer.array()
    //clean()
    return Base64.encodeToString(cipherMessage, Base64.DEFAULT)
}

So i must show all these informations on a list, so Im decrypting all information on viewholder. the problem is that is too slow when it shows a lot of items, so i decided to try an async descrypt inside the viewholder and for my surprise i got a lot of "Unitialized keystore" exception, letting y data encrypted, it's weird because when i scroll down and up, some viewholders decrypt successfull and others not, it's pretty random, an it seems that viewholder try to decrypt more than once. PS: I can't cache decrypted data on SharedPrerences for security reasons

fun decription(encStr: String): String? {
    return try {
        dec(encStr)
    } catch (e: Throwable) {
        Log.d("cripto", "Here, Trowing Unitialized Keystore")
        if (!BuildConfig.DEBUG){
            Crashlytics.logException(e)
        }
        null
    }
}

private fun dec(encStr: String): String {
    val byteBuffer = ByteBuffer.wrap(Base64.decode(encStr, Base64.DEFAULT))
    val ivLength = byteBuffer.int
    if (ivLength < 12 || ivLength >= 16) { // check input parameter
        throw IllegalArgumentException("invalid iv length")
    }
    val iv = ByteArray(ivLength)
    byteBuffer.get(iv)
    val cipherText = ByteArray(byteBuffer.remaining())
    byteBuffer.get(cipherText)
    return callCip(cipherText, iv)

}

private fun callCip(cipText: ByteArray, iv: ByteArray): String {
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
    cipher.init(Cipher.DECRYPT_MODE, getSecretKey(), GCMParameterSpec(128, iv))
    val plainText = cipher.doFinal(cipText)
    return String(plainText)
}

And my viewholder code:

    doAsync {

            var name = ""
            var lname = ""
            var patRecord = ""

            if (value?.patient != null){
                name = PatSecHelper.nToPat(value.patient?.name?.trim() ?: "")
                lname = PatSecHelper.nToPat(value.patient?.lastName?.trim() ?: "")
                patRecord = PatSecHelper.nToPat(value.patient?.patientRecord?.trim() ?: "")

            }

            onComplete {
                if (value?.patient == null){
                    view.textViewPatientId.visibility = View.GONE
                }else{
                    if (name == "" || lname == "") {
                        view.textViewPatient.text = "Error..."
                    }else{
                        view.textViewPatient.text = "$name $lname"
                    }
                    if (patRecord == ""){
                        view.textViewPatientId.text = "Error..."
                    }else{
                        view.textViewPatientId.text = patRecord
                    }

                }

            }
        }

**EDIT:

Here is the code that i'm using to genarete and get keys

    private fun generateKey(){
    keyStore = KeyStore.getInstance(AndroidKeyStore)
    keyStore.load(null)

    if (!keyStore.containsAlias(KEY_ALIAS)) {
        val keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, AndroidKeyStore)
        keyGenerator.init(
                KeyGenParameterSpec.Builder(KEY_ALIAS,
                        KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
                        .setBlockModes(KeyProperties.BLOCK_MODE_GCM).setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
                        .setRandomizedEncryptionRequired(false)
                        .build())
        keyGenerator.generateKey()
    }
}

@Throws(Exception::class)
private fun getSecretKey(): java.security.Key {
    keyStore = KeyStore.getInstance(AndroidKeyStore)
    keyStore.load(null)
    return keyStore.getKey(KEY_ALIAS, null)
}

Solution

Here are the problems I see:

I am not sure what the implementation is of generateKey() but if it does what it says on the tin then don't generate your key every time you encrypt. As I believe you are doing here:

private fun encript(plain: String): String? {
    return try {
        generateKey() // <- why are you doing this every time? are you storing a unique key with everything you encrypt?
        encData(plain)
    } catch (e: Throwable) {
        if (!BuildConfig.DEBUG) {
            Crashlytics.logException(e)
        }
        null
    }
}

This will mean you have a new key every time you encrypt something? Rather, this should be initialized and ready before you try to encrypt/decrypt.

And, if this is the only place you do generate your key, then how do you know that when you call this:

private fun callCip(cipText: ByteArray, iv: ByteArray): String {
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")
    cipher.init(Cipher.DECRYPT_MODE, getSecretKey(), GCMParameterSpec(128, iv)) // <- Are you sure you have called encrypt before callin this?
    val plainText = cipher.doFinal(cipText)
    return String(plainText)
}

That you have a key generated to be fetched? Pulling out generateKey() and making sure you have called it before you do any encrypt/decrypt actions should fix your problem I think.

Answered By - Laurence