Failed to attest the validity of the generated cryptographic key AppAttest

[Kondamon]

Description

For some users I receive an error when calling: AppCheck.appCheck().token(forcingRefresh: false)

´´´
The operation couldn’t be completed. Failed to attest the validity of the generated cryptographic key (attestKey:clientDataHash:completionHandler:); keyId.length = 44, clientDataHash.length = 32
´´´

Reproducing the issue

Not all users are affected, only some of them. When a user is affected the error persists and the user never retrieve an app check token.

Firebase SDK Version

10.19.1

Xcode Version

15.0

Installation Method

Swift Package Manager

Firebase Product(s)

AB Testing, Analytics, App Check, Crashlytics, In-App Messaging, Messaging, Remote Config, Storage

Targeted Platforms

iOS

Relevant Log Output

The operation couldn’t be completed. Failed to attest the validity of the generated cryptographic key (`attestKey:clientDataHash:completionHandler:`); keyId.length = 44, clientDataHash.length = 32

If using Swift Package Manager, the project's Package.resolved

Expand Package.resolved snippet

{
  "pins" : [
    {
      "identity" : "abseil-cpp-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/abseil-cpp-binary.git",
      "state" : {
        "revision" : "bfc0b6f81adc06ce5121eb23f628473638d67c5c",
        "version" : "1.2022062300.0"
      }
    },
    {
      "identity" : "app-check",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/app-check.git",
      "state" : {
        "revision" : "5746b2d35c91c50581590ed97abe4c06b5037274",
        "version" : "10.18.0"
      }
    },
    {
      "identity" : "firebase-ios-sdk",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/firebase-ios-sdk",
      "state" : {
        "revision" : "c60c958e707c50a9cf8bcb7cfd7d51c566d726c5",
        "version" : "10.19.1"
      }
    },
    {
      "identity" : "googleappmeasurement",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleAppMeasurement.git",
      "state" : {
        "revision" : "6b332152355c372ace9966d8ee76ed191f97025e",
        "version" : "10.17.0"
      }
    },
    {
      "identity" : "googledatatransport",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleDataTransport.git",
      "state" : {
        "revision" : "a732a4b47f59e4f725a2ea10f0c77e93a7131117",
        "version" : "9.3.0"
      }
    },
    {
      "identity" : "googleutilities",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/GoogleUtilities.git",
      "state" : {
        "revision" : "bc27fad73504f3d4af235de451f02ee22586ebd3",
        "version" : "7.12.1"
      }
    },
    {
      "identity" : "grpc-binary",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/grpc-binary.git",
      "state" : {
        "revision" : "a673bc2937fbe886dd1f99c401b01b6d977a9c98",
        "version" : "1.49.1"
      }
    },
    {
      "identity" : "gtm-session-fetcher",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/gtm-session-fetcher.git",
      "state" : {
        "revision" : "115f75e43851774934d695449a4836123c3246e1",
        "version" : "3.2.0"
      }
    },
    {
      "identity" : "interop-ios-for-google-sdks",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/interop-ios-for-google-sdks.git",
      "state" : {
        "revision" : "2d12673670417654f08f5f90fdd62926dc3a2648",
        "version" : "100.0.0"
      }
    },
    {
      "identity" : "leveldb",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/leveldb.git",
      "state" : {
        "revision" : "9d108e9112aa1d65ce508facf804674546116d9c",
        "version" : "1.22.3"
      }
    },
    {
      "identity" : "nanopb",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/firebase/nanopb.git",
      "state" : {
        "revision" : "819d0a2173aff699fb8c364b6fb906f7cdb1a692",
        "version" : "2.30909.0"
      }
    },
    {
      "identity" : "promises",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/google/promises.git",
      "state" : {
        "revision" : "e70e889c0196c76d22759eb50d6a0270ca9f1d9e",
        "version" : "2.3.1"
      }
    {
      "identity" : "swift-collections",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-collections",
      "state" : {
        "revision" : "d029d9d39c87bed85b1c50adee7c41795261a192",
        "version" : "1.0.6"
      }
    },
    {
      "identity" : "swift-dependencies",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/pointfreeco/swift-dependencies",
      "state" : {
        "revision" : "c31b1445c4fae49e6fdb75496b895a3653f6aefc",
        "version" : "1.1.5"
      }
    },
    {
      "identity" : "swift-log",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-log.git",
      "state" : {
        "revision" : "e97a6fcb1ab07462881ac165fdbb37f067e205d5",
        "version" : "1.5.4"
      }
    },
    {
      "identity" : "swift-protobuf",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-protobuf.git",
      "state" : {
        "revision" : "0af9125c4eae12a4973fb66574c53a54962a9e1e",
        "version" : "1.21.0"
      }
    },
    {
      "identity" : "swift-syntax",
      "kind" : "remoteSourceControl",
      "location" : "https://github.com/apple/swift-syntax.git",
      "state" : {
        "revision" : "6ad4ea24b01559dde0773e3d091f1b9e36175036",
        "version" : "509.0.2"
      }
    },
  ],
  "version" : 2
}

If using CocoaPods, the project's Podfile.lock

Expand Podfile.lock snippet

Replace this line with the contents of your Podfile.lock!

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[paulb777]

We haven't yet been able to reliably reproduce. Rebooting the device may be a workaround.

[stadskle]

We also have users with this issue (although we are using the react native integration), but so far not able to reproduce on other devices. We do not force refresh in our configuration.

[asegurola]

Seeing the same thing with the flutter package https://pub.dev/packages/firebase_app_check version 0.2.1+8
Also not forcing refresh.
The problem only happens on iOS devices that's how I ended up here.

For us it seems to be happening only on iOS 17.x although to be fair most of our userbase is in 17 anyways so that might just be a coincidence

[ChristianEasi]

There is also a Github issue for flutterfire, also for iOS 16 users:
firebase/flutterfire#11629

[mlalty]

We have had the same problem in our native iOS App for 2-3 weeks.
Unfortunately, it cannot be reproduced. Therefore we have installed a logging and we can observe that the error occurs. Unfortunately it is not possible with a

• Restarting the app
• Delete app data

is not enough. In some cases, however, it is sufficient to reinstall the app. But nobody wants that.

Logging

1. get Token
   AppCheck.appCheck().token(forcingRefresh: false)

We get this as an error
AppCheckErrorCode.unknown

2. get Token forcingRefresh:true
   AppCheck.appCheck().token(forcingRefresh: true)

We get this as an error
Failed to create a block of data that demonstrates the legitimacy of the app instance (generateAssertion:clientDataHash:completionHandler:); keyId.length = 44, clientDataHash.length = 32; DCErrorInvalidKey - An error caused by a failed attempt to use the App Attest key.

What we see is that there are users where the token has expired after a long time.

Update:
Further error messages appear after a forcingrefresh:true

The process could not be completed. The validity of the generated cryptographic key could not be confirmed (attestKey:clientDataHash:completionHandler:); keyId.length = 44, clientDataHash.length = 32; DCErrorInvalidInput - An error code that indicates when your application provides data that is not formatted correctly.

Update:

We are getting more and more users (~daily 50) who run into this errors. We have already tried to change the appcheck provider after restarting the app, unfortunately without success. By increasing the token expirationtime we can prolong this errors a bit. The problem is that our users no longer have access to their Firestore data.

Is there a programmatic way to let the user run into an appcheck token reset?

[hassaan22]

Experiencing similar issues, I posted in discussion: #12629

[yehudab]

Seeing the same issue.
We are still in the development process, so don't have stats from the field, but at least on test devices the behavior seems to be this:

• First attempt to generate a token succeeds.
• Any subsequent attempts to generate a token (via forcingRefresh: true or if the first token expires) fails with the DCErrorInvalidInput error
• Re-installing the app resets the situation to step 1 (but is not a reasonable workaround)

Following the discussion in #12629 we upgraded to FirebaseAppCheck version 10.28.0 (which uses AppCheckCore 10.19), but it doesn't seem to fix the issue.

Example full error message:

The operation couldn’t be completed. Failed to create a block of data that demonstrates the legitimacy of the app instance (`generateAssertion:clientDataHash:completionHandler:`); keyId.length = 44, clientDataHash = 1VrzzodyoztSPweBhpUyEvw6mGQE+QpB5PNQruZTDKs=, systemVersion = 17.5.1; DCErrorInvalidInput - An error code that indicates when your app provides data that isn’t formatted correctly

[willnix86]

We're still see these issues too. failed to create a block of data and validity of the generated cryptographic key could not be confirmed for a fair amount of users.

[naruogram]

We too are encountering the same error. Only some users are experiencing this and we don't know the cause.
When will this be fixed?