Pixel 8 Auditor Failed to generate key pair

brad

Hello. Today I installed GOS on my brand new Pixel 8. Now I want to check the integrity with the Auditor app but get the following error:

java.security.ProviderException: Failed to generate key pair.

If I check with my Pixel 8 my previous phone, the Pixel 7, does it work normally.
I restarted already the Pixel 8.

brad

Update:

I reinstalled GOS on the Pixel 8 again via the website and checked the integrity directly with the Auditor, which gave positive feedback. Because I want to restore my backup, which I created via GOS (Seedvault) on my Pixel 7 to the Pixel 8, I reset the Pixel 8 to the factory settings via the settings and restored the backup of my Pixel 7 within the setup wizard of GOS. Then I went straight back into the Auditor and tried to check the integrity again. Now I get the error mentioned above again. What is the problem here?

other8026

brad I'll admit I don't know much about Auditor, so hopefully someone can come along and offer more or better advice.

besides the error saying that it couldn't generate a key pair, do you see anything else?
Is your phone connected to the internet and is your time set correctly?
Did you lock the bootloader after flashing GrapheneOS?
Have you tried remote attestation (https://attestation.app/tutorial#scheduled-remote-verification Under "Scheduled remote verification")? Does it pass?

What I find confusing about this error is that I can't seem to find it in the Auditor code (I just did a Control + F and typed the error as you typed it). I'm not sure what could be causing it.

brad

other8026

Thank you for your answer.

besides the error saying that it couldn't generate a key pair, do you see anything else?

unfortunately no

Is your phone connected to the internet and is your time set correctly?

yes

Did you lock the bootloader after flashing GrapheneOS?

yes

Have you tried remote attestation (https://attestation.app/tutorial#scheduled-remote-verification Under "Scheduled remote verification")? Does it pass?

yes I try it, but I get the same error

I have since reset the Pixel 8 to the factory settings, went back into the Auditor and am now receiving positive feedback again. Since it seems to have to do with importing the backup, I am now setting up the phone again manually.

other8026

brad Since it seems to have to do with importing the backup

It does sound like that is the culprit. I have no clue why it would happen, though. Maybe someone who knows will come along and explain.

Hopefully after you've used your phone for a while, you'll still get successful verifications moving forward.

Onlyfun

brad i have experienced same issue, couldn't determine the root and ended up manually transferring instead of built in backup/restore proceedure. i dont rely on it anyway, it has many flaws which i learned the hard way. for example it would perfectly restore some apps with contents and at the same time fail to do so with other apps without an obvious to me pattern which resulted is some heavy data losses. so manual copy-paste every important file, and/or make use of in-app's backup/restore features if available

brad

other8026

I hope so too. Thank you again for your help.

[deleted]

brad How did it go? I have the same issue om the device i installed from a seedvault backup.

mick_vgo

Try clearing both Auditor and KeyChain data.

e.g. from ADB:
adb shell pm clear app.attestation.auditor
adb shell pm clear com.android.keychain

Seems like Seedvault tries to backup system app data, and I don't think it's possible to exclude them from being restored :/

[deleted]

mick_vgo Well u can exclude them to be backed up in the first place afaik.

snrkl

mick_vgo

I just tried this, and I can confirm that it clearing the auditor and keychain data does not fix the issue.

PolarOctopus

I'm experiencing the same issue, also after restoring a backup via seedvault on a different phone. Does anyone have other ideas of system app data to clear? I'm guessing attestation in general is broken on this phone, not just the Auditor app. In general seedvault worked pretty well for me, so it'd be a bit of a shame to start from scratch without it.

PolarOctopus

I figured it out:

adb shell pm clear com.android.rkpdapp

The above command fixes attestation on the device. Unfortunately this system app's data can't be cleared from the app list (even after "show system apps"), so you need to enable adb for this. It'd be nice if this was blacklisted from seedvault export/import :)

I also cleared the "key chain" com.android.keychain and Auditor app app.attestation.auditor data at some point, so it's possible clearing those are required as well.

de0u

lamanetwork The option is "greyed out" in the "RemoteProvisioner"

Then the next step would probably be to try the adb command that PolarOctopus suggested. Given the statement by GrapheneOS I think that command should be safe.

If you go that route, it is probably wise to follow up by invoking "Revoke USB debugging authorizations" in the developer options, and then to turn off the "Use developer options" toggle at the top.

GrapheneOS

You can clear RemoteProvisioner (com.android.rkpdapp) system app data via the Settings app to work around this. We've excluded it from backups for the next OS release.

lamanetwork

GrapheneOS

.'ve got the same issue after restoring to an new pixel, but I can't find the remoteprovisioner in the settings. Where can I find it?

de0u

lamanetwork I've got the same issue after restoring to an new pixel, but I can't find the remoteprovisioner in the settings.

Settings, Apps, "See all __ apps", "vertical ellipsis" menu (⋮), "Show system", scroll down to "RemoteProvisioner", tap on it, "Storage & cache". I believe the suggestion is to "Clear storage" and "Clear cache".

lamanetwork

de0u Thanks for your response. The option is "greyed out" in the "RemoteProvisioner"