title: android.security.KeyStoreException: Invalid key blob
body: <p>I cannot obtain a (private) key from KeyStore on Android. Problem occurs mainly
  on Samsung devices (S6, S6 Edge) and Android 6.</p>
  
  <p><strong>android.security.KeyStoreException: Invalid key blob</strong></p>
  
  <p>is thrown when following line is called (where alias is name for store key).</p>
  
  <pre><code>KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry)keyStore.getEntry(alias, null);
  </code></pre>
  
  <p>The KeyStore itself is obtained by</p>
  
  <pre><code>KeyStore.getInstance("AndroidKeyStore");
  </code></pre>
  
  <p>And key is generated by the following method:</p>
  
  <pre><code>private static void createKey(String alias, String subject, KeyStore keyStore, BigInteger serialNumber, Date startDate, Date endDate, String algorithm, String keyStoreProvider, Context context)
              throws KeyStoreException, NoSuchProviderException, NoSuchAlgorithmException, InvalidAlgorithmParameterException {
      if (keyStore.containsAlias(alias)) {
          // Key already exists.
          return;
      }
  
      // Generate keys.
      KeyPairGeneratorSpec spec = new KeyPairGeneratorSpec.Builder(context)
              .setAlias(alias)
              .setSubject(new X500Principal(subject))
              .setSerialNumber(serialNumber)
              .setStartDate(startDate)
              .setEndDate(endDate)
              .build();
  
      KeyPairGenerator generator = KeyPairGenerator.getInstance(algorithm, keyStoreProvider);
      generator.initialize(spec);
  
      KeyPair keyPair = generator.generateKeyPair();
  }
  </code></pre>
  
  <p>Where algorithm is "RSA" and keyStoreProvider is "AndroidKeyStore".</p>
  
  <p>The part of the stacktrace:</p>
  
  <pre><code>android.security.KeyStoreException: Invalid key blob
         at android.security.KeyStore.getKeyStoreException(KeyStore.java:939)
         at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePublicKeyFromKeystore(AndroidKeyStoreProvider.java:216)
         at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyPairFromKeystore(AndroidKeyStoreProvider.java:252)
         at android.security.keystore.AndroidKeyStoreProvider.loadAndroidKeyStorePrivateKeyFromKeystore(AndroidKeyStoreProvider.java:263)
         at android.security.keystore.AndroidKeyStoreSpi.engineGetKey(AndroidKeyStoreSpi.java:93)
         at java.security.KeyStoreSpi.engineGetEntry(KeyStoreSpi.java:372)
         at java.security.KeyStore.getEntry(KeyStore.java:645)
  </code></pre>
  
  <p>The exception causes <em>java.security.UnrecoverableKeyException: Failed to obtain information about private key</em> to be thrown.</p>
  
  <p>I was not able to find any closer information about "Invalid key blob",
  only that the message itself is defined here: <a href="https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/security/keymaster/KeymasterDefs.java" rel="noreferrer">https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/security/keymaster/KeymasterDefs.java</a></p>