Android 12 Keystore creation issue

Overview

NFC Wallet SDK creates an Android Keystore key that requires end-user authentication. This key protects payment assets used during contactless payments. On some devices, key creation fails when authentication is required.

This issue blocks wallet access and payments when CDCVM requires device authentication.

Symptoms

The digital wallet application creates the key when it initializes Device CVM. This happens when you call DeviceCVMManager.INSTANCE.initialize(CHVerificationMethod).

The issue typically occurs with:

• CHVerificationMethod.DEVICE_KEYGUARD
• CHVerificationMethod.BIOMETRICS

When key creation fails, NFC Wallet SDK throws DeviceCVMException. The message is typically:

Problem creating AKS key. Failed to store private key

// Initialize Device CVM for the wallet
DeviceCVMManager.INSTANCE.initialize(CHVerificationMethod.BIOMETRICS);

When you reproduce with a debug build of NFC Wallet SDK, you may also see:

java.security.KeyStoreException: Failed to store private key
 at android.security.keystore2.AndroidKeyStoreSpi.setPrivateKeyEntry(AndroidKeyStoreSpi.java:581)
 at android.security.keystore2.AndroidKeyStoreSpi.engineSetEntry(AndroidKeyStoreSpi.java:1211)
 at java.security.KeyStore.setEntry(KeyStore.java:1617)
 at java.lang.reflect.Method.invoke(Native Method)
 …
 Caused by: android.security.KeyStoreException: Keystore not initialized
   at android.security.KeyStore2.getKeyStoreException(KeyStore2.java:384)
   at android.security.KeyStoreSecurityLevel.handleExceptions(KeyStoreSecurityLevel.java:59)
   at android.security.KeyStoreSecurityLevel.importKey(KeyStoreSecurityLevel.java:204
   …

Root cause

A similar Android platform issue is tracked on Google Issue Tracker. See issue 195330769.

Google indicates the fix is available starting with Android 12L. The fix is not backported to Android 12.

Affected Android versions and devices

Most reports are on Android 12, often on Xiaomi devices. As of Feb 2026, the following non-exhaustive list is reported:

Vendor	Model	Android version	API level
Honor	NTH-NX9	Android 12	31
LGE	LG-US996	Android 8.0	26
OnePlus	KB2003	Android 12	31
Samsung	SM-G998B	Android 12	31
Samsung	SM-G998U	Android 12	31
Samsung	SM-A426BZKHXSP	Android 12	31
Samsung	SM-A516U	Android 12	31
Xiaomi	M2101K7BNY	Android 12	31
Xiaomi	2109119DG	Android 12	31
Xiaomi	22031116BG	Android 12	31
Xiaomi	M2007J3SG	Android 12	31
Xiaomi	M2012K11G	Android 12	31
Xiaomi	M2007J17G	Android 12	31
Xiaomi	M2101K9G	Android 12	31
Xiaomi	M2007J20CG	Android 12	31
Xiaomi	21081111RG	Android 12	31
Xiaomi	M2004J19C	Android 11	30
Xiaomi	POCO F2 Pro	Android 12	31
Xiaomi	M2011K2G	Android 12	31
Xiaomi	M2102J20SG	Android 12	31

Workarounds and next steps

1. If the device runs Android 12, upgrade to Android 12L or later.
2. If the device runs another version, reset device lock and biometrics.

   • Remove the screen lock.
   • Reboot the device.
   • Re-enroll biometrics.
   • Set the screen lock again.
3. Retry Device CVM initialization.

If the issue reproduces on non-Android 12 devices, open a support ticket. Share device model, Android version, and full logs. Follow How to report issues with Thales NFC Wallet SDK?. Capture logs with Retrieve logs from an Android device.