java.security.NoSuchAlgorithmException: SHA-256 MessageDigest not available about certificate-transparency-android

[mattmook]

Hi @darwind,

What manufacturers do you see this across?

According to the docs SHA-256 should be supported across all Android OS versions (since API 1).

Throwing random thoughts out there, do you use any JNI in your app? https://stackoverflow.com/questions/17877419/android-messagedigest-nosuchalgorithmexception-after-calling-jni-function

[darwind]

Hi @darwind,

What manufacturers do you see this across?

According to the docs SHA-256 should be supported across all Android OS versions (since API 1).

Throwing random thoughts out there, do you use any JNI in your app? https://stackoverflow.com/questions/17877419/android-messagedigest-nosuchalgorithmexception-after-calling-jni-function

Thanks for getting back to me.

Yes I would also expect all devices to support SHA-256, unless the manufacturers mess up something of course.

We see this on:
Huawei (P30 lite, P20 Pro, P smart 2019, Mate 9 Pro and P20 Lite)
Samsung (Galaxy S9 and Galaxy A41)
OnePlus (6T)

However we've only seen roughly 10 crashes with 10 different users, but with a userbase of roughly 300.000 users on Android it's not affecting a lot of users obviously.

I went digging through our 3rd party libraries and we're actually using an OCR engine, which is a proprietary library so I don't have access to the source code apart from the obfuscated code and this OCR engine is actually using RenderScript, so yes indirectly we're using JNI I suppose :-) The OCR engine is initialised inside our Application class as the first thing we're doing and then the first call to our backend is made a little later when the user presses a button, so I guess this could actually be the issue.

I don't have access to any of the users that experience this issue so it's gonna be hard to test out whether changing the call order will fix this issue of course.

[mattmook]

I can put a workaround in by having a fallback implementation of SHA-256, however, I am concerned it's just going to shift the problem elsewhere in the code.

Of course it's hard to know if it is the OCR library causing the issues... seems other Android libraries have experienced similar issues with no real resolution (Mixpanel, Amplitude-Android).

[mattmook]

Next release will use SHA256 directly from BC rather than through MessageDigest so the above exception can no longer occur. I guess we'll have to see whether there are any further unexplained exceptions further down the line