@@ -513,20 +513,8 @@ private boolean isValidAESKeyLength(byte[] aesKey) {
513513 */
514514 @ VisibleForTesting
515515 byte [] getAESKey () throws IncompatibleDeviceException , CryptoException {
516- return getAESKey (true );
517- }
518-
519- /**
520- * Attempts to recover the existing AES Key or generates a new one if none is found.
521- *
522- * @param attemptMigration whether to attempt PKCS1→OAEP migration on decryption failure
523- * @return a valid AES Key bytes
524- * @throws IncompatibleDeviceException in the event the device can't understand the cryptographic settings required
525- * @throws CryptoException if the stored RSA keys can't be recovered and should be deemed invalid
526- */
527- private byte [] getAESKey (boolean attemptMigration ) throws IncompatibleDeviceException , CryptoException {
528516 // Step 1: Try to recover existing AES key encrypted with current format (OAEP)
529- byte [] aesKey = tryRecoverCurrentAESKey (attemptMigration );
517+ byte [] aesKey = tryRecoverCurrentAESKey ();
530518 if (aesKey != null ) {
531519 return aesKey ;
532520 }
@@ -543,15 +531,14 @@ private byte[] getAESKey(boolean attemptMigration) throws IncompatibleDeviceExce
543531
544532 /**
545533 * Attempts to recover the AES key stored at KEY_ALIAS using OAEP decryption.
546- * If OAEP fails and migration is enabled , attempts PKCS1 decryption for legacy data.
534+ * If OAEP fails, attempts PKCS1 decryption for legacy data migration .
547535 *
548- * @param attemptMigration whether to attempt PKCS1 migration on OAEP failure
549536 * @return the decrypted AES key, or null if no key exists or recovery failed
550537 * @throws IncompatibleDeviceException if the device doesn't support required crypto operations
551538 * and migration also fails
552539 */
553540 @ Nullable
554- private byte [] tryRecoverCurrentAESKey (boolean attemptMigration ) throws IncompatibleDeviceException {
541+ private byte [] tryRecoverCurrentAESKey () throws IncompatibleDeviceException {
555542 String encodedEncryptedAES = storage .retrieveString (KEY_ALIAS );
556543 if (TextUtils .isEmpty (encodedEncryptedAES )) {
557544 return null ;
@@ -566,15 +553,13 @@ private byte[] tryRecoverCurrentAESKey(boolean attemptMigration) throws Incompat
566553 // OAEP decryption failed - could be legacy PKCS1 data or device incompatibility
567554 // Store exception to re-throw if migration also fails
568555 oaepException = e ;
569- Log .d (TAG , "OAEP decryption failed. attemptMigration=" + attemptMigration , e );
556+ Log .d (TAG , "OAEP decryption failed, attempting PKCS1 migration" , e );
570557 }
571558
572- // OAEP failed - attempt PKCS1 migration if enabled
573- if (attemptMigration ) {
574- byte [] migratedKey = attemptPKCS1Migration (encryptedAESBytes );
575- if (migratedKey != null ) {
576- return migratedKey ;
577- }
559+ // OAEP failed - attempt PKCS1 migration
560+ byte [] migratedKey = attemptPKCS1Migration (encryptedAESBytes );
561+ if (migratedKey != null ) {
562+ return migratedKey ;
578563 }
579564
580565 // Migration failed or wasn't attempted
0 commit comments