Fix Android AEAD tag mismatch exceptions

src/libraries/Common/src/Interop/Android/System.Security.Cryptography.Native.Android/Interop.Cipher.cs

@@ -101,6 +101,32 @@ ref MemoryMarshal.GetReference(input),
                 input.Length);
         }
 
+        [LibraryImport(Libraries.AndroidCryptoNative, EntryPoint = "AndroidCryptoNative_AeadCipherUpdate")]
+        [return: MarshalAs(UnmanagedType.Bool)]
+        private static partial bool EvpAeadCipherUpdate(
+            SafeEvpCipherCtxHandle ctx,
+            Span<byte> output,
+            out int outl,
+            ReadOnlySpan<byte> input,
+            int inl,
+            [MarshalAs(UnmanagedType.Bool)] out bool authTagMismatch);
+
+        internal static bool EvpAeadCipherUpdate(
+            SafeEvpCipherCtxHandle ctx,
+            Span<byte> output,
+            out int bytesWritten,
+            ReadOnlySpan<byte> input,
+            out bool authTagMismatch)
+        {
+            return EvpAeadCipherUpdate(
+                ctx,
+                output,
+                out bytesWritten,
+                input,
+                input.Length,
+                out authTagMismatch);
+        }
+
         [LibraryImport(Libraries.AndroidCryptoNative, EntryPoint = "AndroidCryptoNative_CipherUpdateAAD")]
         [return: MarshalAs(UnmanagedType.Bool)]
         private static partial bool CipherUpdateAAD(

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/AesCcm.Android.cs

@@ -125,6 +125,30 @@ private void DecryptCore(
             ReadOnlySpan<byte> tag,
             Span<byte> plaintext,
             ReadOnlySpan<byte> associatedData)
+        {
+            try
+            {
+                DecryptCoreOnce(nonce, ciphertext, tag, plaintext, associatedData);
+            }
+            catch (CryptographicException ex) when (ex is not AuthenticationTagMismatchException)
+            {
+                // Work around a transient Android/Conscrypt issue: an AEAD authentication
+                // failure can surface with the wrong exception type because the provider
+                // derives it from BoringSSL's thread-local error queue, which may still hold
+                // a stale error from an unrelated prior operation on the same thread. The
+                // failed attempt clears that queue, so an immediate same-thread retry observes
+                // the true result. A valid ciphertext cannot reach this path, so the retry can
+                // never turn an authentication failure into unauthenticated plaintext.
+                DecryptCoreOnce(nonce, ciphertext, tag, plaintext, associatedData);
+            }
+        }
+
+        private void DecryptCoreOnce(
+            ReadOnlySpan<byte> nonce,
+            ReadOnlySpan<byte> ciphertext,
+            ReadOnlySpan<byte> tag,
+            Span<byte> plaintext,
+            ReadOnlySpan<byte> associatedData)
         {
             bool acquired = false;
 
@@ -159,9 +183,20 @@ private void DecryptCore(
                         throw new CryptographicException();
                     }
 
-                    if (!Interop.Crypto.EvpCipherUpdate(ctx, plaintext.Slice(plaintextBytesWritten), out int bytesWritten, tag))
+                    if (!Interop.Crypto.EvpAeadCipherUpdate(
+                        ctx,
+                        plaintext.Slice(plaintextBytesWritten),
+                        out int bytesWritten,
+                        tag,
+                        out bool authTagMismatch))
                     {
                         CryptographicOperations.ZeroMemory(plaintext);
+
+                        if (authTagMismatch)
+                        {
+                            throw new AuthenticationTagMismatchException();
+                        }
+
                         throw new CryptographicException();
                     }
 
@@ -171,7 +206,7 @@ private void DecryptCore(
                         ctx,
                         plaintext.Slice(plaintextBytesWritten),
                         out bytesWritten,
-                        out bool authTagMismatch))
+                        out authTagMismatch))
                     {
                         CryptographicOperations.ZeroMemory(plaintext);
 

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/AesGcm.Android.cs

@@ -114,6 +114,30 @@ private partial void DecryptCore(
             ReadOnlySpan<byte> tag,
             Span<byte> plaintext,
             ReadOnlySpan<byte> associatedData)
+        {
+            try
+            {
+                DecryptCoreOnce(nonce, ciphertext, tag, plaintext, associatedData);
+            }
+            catch (CryptographicException ex) when (ex is not AuthenticationTagMismatchException)
+            {
+                // Work around a transient Android/Conscrypt issue: an AEAD authentication
+                // failure can surface with the wrong exception type because the provider
+                // derives it from BoringSSL's thread-local error queue, which may still hold
+                // a stale error from an unrelated prior operation on the same thread. The
+                // failed attempt clears that queue, so an immediate same-thread retry observes
+                // the true result. A valid ciphertext cannot reach this path, so the retry can
+                // never turn an authentication failure into unauthenticated plaintext.
+                DecryptCoreOnce(nonce, ciphertext, tag, plaintext, associatedData);
+            }
+        }
+
+        private void DecryptCoreOnce(
+            ReadOnlySpan<byte> nonce,
+            ReadOnlySpan<byte> ciphertext,
+            ReadOnlySpan<byte> tag,
+            Span<byte> plaintext,
+            ReadOnlySpan<byte> associatedData)
         {
             if (!Interop.Crypto.CipherSetTagLength(_ctxHandle, tag.Length))
             {
@@ -137,9 +161,20 @@ private partial void DecryptCore(
                 throw new CryptographicException();
             }
 
-            if (!Interop.Crypto.EvpCipherUpdate(_ctxHandle, plaintext.Slice(plaintextBytesWritten), out int bytesWritten, tag))
+            if (!Interop.Crypto.EvpAeadCipherUpdate(
+                _ctxHandle,
+                plaintext.Slice(plaintextBytesWritten),
+                out int bytesWritten,
+                tag,
+                out bool authTagMismatch))
             {
                 CryptographicOperations.ZeroMemory(plaintext);
+
+                if (authTagMismatch)
+                {
+                    throw new AuthenticationTagMismatchException();
+                }
+
                 throw new CryptographicException();
             }
 
@@ -149,7 +184,7 @@ private partial void DecryptCore(
                 _ctxHandle,
                 plaintext.Slice(plaintextBytesWritten),
                 out bytesWritten,
-                out bool authTagMismatch))
+                out authTagMismatch))
             {
                 CryptographicOperations.ZeroMemory(plaintext);
 

src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/ChaCha20Poly1305.Android.cs

@@ -109,6 +109,30 @@ private void DecryptCore(
             ReadOnlySpan<byte> tag,
             Span<byte> plaintext,
             ReadOnlySpan<byte> associatedData)
+        {
+            try
+            {
+                DecryptCoreOnce(nonce, ciphertext, tag, plaintext, associatedData);
+            }
+            catch (CryptographicException ex) when (ex is not AuthenticationTagMismatchException)
+            {
+                // Work around a transient Android/Conscrypt issue: an AEAD authentication
+                // failure can surface with the wrong exception type because the provider
+                // derives it from BoringSSL's thread-local error queue, which may still hold
+                // a stale error from an unrelated prior operation on the same thread. The
+                // failed attempt clears that queue, so an immediate same-thread retry observes
+                // the true result. A valid ciphertext cannot reach this path, so the retry can
+                // never turn an authentication failure into unauthenticated plaintext.
+                DecryptCoreOnce(nonce, ciphertext, tag, plaintext, associatedData);
+            }
+        }
+
+        private void DecryptCoreOnce(
+            ReadOnlySpan<byte> nonce,
+            ReadOnlySpan<byte> ciphertext,
+            ReadOnlySpan<byte> tag,
+            Span<byte> plaintext,
+            ReadOnlySpan<byte> associatedData)
         {
             Interop.Crypto.EvpCipherSetKeyAndIV(
                 _ctxHandle,
@@ -127,9 +151,20 @@ private void DecryptCore(
                 throw new CryptographicException();
             }
 
-            if (!Interop.Crypto.EvpCipherUpdate(_ctxHandle, plaintext.Slice(plaintextBytesWritten), out int bytesWritten, tag))
+            if (!Interop.Crypto.EvpAeadCipherUpdate(
+                _ctxHandle,
+                plaintext.Slice(plaintextBytesWritten),
+                out int bytesWritten,
+                tag,
+                out bool authTagMismatch))
             {
                 CryptographicOperations.ZeroMemory(plaintext);
+
+                if (authTagMismatch)
+                {
+                    throw new AuthenticationTagMismatchException();
+                }
+
                 throw new CryptographicException();
             }
 
@@ -139,7 +174,7 @@ private void DecryptCore(
                 _ctxHandle,
                 plaintext.Slice(plaintextBytesWritten),
                 out bytesWritten,
-                out bool authTagMismatch))
+                out authTagMismatch))
             {
                 CryptographicOperations.ZeroMemory(plaintext);
 

src/native/libs/System.Security.Cryptography.Native.Android/pal_cipher.c

@@ -76,6 +76,25 @@ ARGS_NON_NULL_ALL static jobject GetAlgorithmName(JNIEnv* env, CipherInfo* type)
     return make_java_string(env, type->name);
 }
 
+ARGS_NON_NULL_ALL static bool CheckJNIExceptionsForAuthTagMismatch(JNIEnv* env, int32_t* authTagMismatch, bool printException)
+{
+    bool result = false;
+    INIT_LOCALS(loc, ex);
+
+    if (TryGetJNIException(env, &loc[ex], printException))
+    {
+        result = true;
+
+        if (loc[ex] != NULL && (*env)->IsInstanceOf(env, loc[ex], g_AEADBadTagExceptionClass))
+        {
+            *authTagMismatch = 1;
+        }
+    }
+
+    RELEASE_LOCALS(loc, env);
+    return result;
+}
+
 int32_t AndroidCryptoNative_CipherIsSupported(CipherInfo* type)
 {
     abort_if_invalid_pointer_argument (type);
@@ -246,34 +265,56 @@ int32_t AndroidCryptoNative_CipherUpdateAAD(CipherCtx* ctx, uint8_t* in, int32_t
 }
 
 int32_t AndroidCryptoNative_CipherUpdate(CipherCtx* ctx, uint8_t* outm, int32_t* outl, uint8_t* in, int32_t inl)
+{
+    int32_t authTagMismatch = 0;
+    return AndroidCryptoNative_AeadCipherUpdate(ctx, outm, outl, in, inl, &authTagMismatch);
+}
+
+int32_t AndroidCryptoNative_AeadCipherUpdate(
+    CipherCtx* ctx, uint8_t* outm, int32_t* outl, uint8_t* in, int32_t inl, int32_t* authTagMismatch)
 {
     if (!ctx)
         return FAIL;
 
+    abort_if_invalid_pointer_argument(authTagMismatch);
+
+    *authTagMismatch = 0;
+
     if (!outl && !in)
         // it means caller wants us to record "inl" but we don't need it.
         return SUCCESS;
 
     abort_if_invalid_pointer_argument(outl);
     abort_if_invalid_pointer_argument(in);
 
+    int32_t result = FAIL;
+    INIT_LOCALS(loc, inDataBytes, outDataBytes);
+
     JNIEnv* env = GetJNIEnv();
-    jbyteArray inDataBytes = make_java_byte_array(env, inl);
-    (*env)->SetByteArrayRegion(env, inDataBytes, 0, inl, (jbyte*)in);
+    loc[inDataBytes] = make_java_byte_array(env, inl);
+    (*env)->SetByteArrayRegion(env, loc[inDataBytes], 0, inl, (jbyte*)in);
+    ON_EXCEPTION_PRINT_AND_GOTO(cleanup);
 
     *outl = 0;
-    jbyteArray outDataBytes = (jbyteArray)(*env)->CallObjectMethod(env, ctx->cipher, g_cipherUpdateMethod, inDataBytes);
+    loc[outDataBytes] = (jbyteArray)(*env)->CallObjectMethod(env, ctx->cipher, g_cipherUpdateMethod, loc[inDataBytes]);
+    if (CheckJNIExceptionsForAuthTagMismatch(env, authTagMismatch, /* printException: */ true))
+    {
+        goto cleanup;
+    }
 
-    if (outDataBytes && outm)
+    if (loc[outDataBytes] && outm)
     {
-        jsize outDataBytesLen = (*env)->GetArrayLength(env, outDataBytes);
+        jsize outDataBytesLen = (*env)->GetArrayLength(env, loc[outDataBytes]);
         *outl = outDataBytesLen;
-        (*env)->GetByteArrayRegion(env, outDataBytes, 0, outDataBytesLen, (jbyte*) outm);
-        (*env)->DeleteLocalRef(env, outDataBytes);
+        (*env)->GetByteArrayRegion(env, loc[outDataBytes], 0, outDataBytesLen, (jbyte*) outm);
+        ON_EXCEPTION_PRINT_AND_GOTO(cleanup);
     }
 
-    (*env)->DeleteLocalRef(env, inDataBytes);
-    return CheckJNIExceptions(env) ? FAIL : SUCCESS;
+    result = SUCCESS;
+
+cleanup:
+    RELEASE_LOCALS(loc, env);
+    return result;
 }
 
 int32_t AndroidCryptoNative_CipherFinalEx(CipherCtx* ctx, uint8_t* outm, int32_t* outl)
@@ -315,21 +356,9 @@ int32_t AndroidCryptoNative_AeadCipherFinalEx(CipherCtx* ctx, uint8_t* outm, int
     *authTagMismatch = 0;
 
     jbyteArray outBytes = (jbyteArray)(*env)->CallObjectMethod(env, ctx->cipher, g_cipherDoFinalMethod);
-    jthrowable ex = NULL;
 
-    if (TryGetJNIException(env, &ex, false))
+    if (CheckJNIExceptionsForAuthTagMismatch(env, authTagMismatch, /* printException: */ false))
     {
-        if (ex == NULL)
-        {
-            return FAIL;
-        }
-
-        if ((*env)->IsInstanceOf(env, ex, g_AEADBadTagExceptionClass))
-        {
-            *authTagMismatch = 1;
-        }
-
-        (*env)->DeleteLocalRef(env, ex);
         return FAIL;
     }
 

src/native/libs/System.Security.Cryptography.Native.Android/pal_cipher.h

@@ -35,6 +35,7 @@ PALEXPORT int32_t AndroidCryptoNative_CipherReset(CipherCtx* ctx, uint8_t* pIv,
 PALEXPORT int32_t AndroidCryptoNative_CipherCtxSetPadding(CipherCtx* ctx, int32_t padding);
 PALEXPORT int32_t AndroidCryptoNative_CipherUpdateAAD(CipherCtx* ctx, uint8_t* in, int32_t inl);
 PALEXPORT int32_t AndroidCryptoNative_CipherUpdate(CipherCtx* ctx, uint8_t* out, int32_t* outl, uint8_t* in, int32_t inl);
+PALEXPORT int32_t AndroidCryptoNative_AeadCipherUpdate(CipherCtx* ctx, uint8_t* out, int32_t* outl, uint8_t* in, int32_t inl, int32_t* authTagMismatch);
 PALEXPORT int32_t AndroidCryptoNative_CipherFinalEx(CipherCtx* ctx, uint8_t* outm, int32_t* outl);
 PALEXPORT int32_t AndroidCryptoNative_AeadCipherFinalEx(CipherCtx* ctx, uint8_t* outm, int32_t* outl, int32_t* authTagMismatch);
 PALEXPORT CipherInfo* AndroidCryptoNative_Aes128Ecb(void);