I've been looking around how server-side encryption works. Thanks to the nextcloud doc I understand the implementation.

Basically, when you first log in a key pair is created, and the private key is encrypted using a key derived from the password of the user. When a new file is a created, a symmetric key is used and that key is encrypted with the public key and can only be decrypted with the private key.

When you want to read that file, you log in, the private key is decrypted by the key derived from the password (and stored in memory), then the symmetric key is decrypted (then you can decrypt the file).

But, I am using two-factor authentication on the server, with a Yubikey. So when I want a desktop client to connect to my nextcloud I use an app password. How is the private key decrypted when I'm using nextcloud desktop client with an app password? Furthermore, the user password is not stored in plain text. Maybe the app password is derived from the user password, but how?

Edit: I'm not looking at how the technique is implemented in Nextcloud in particular, just at a general explanation on how it can be done.

2 Answers 2


Say we have an asymmetric key pair, where public key A can be stored freely and private key B is encrypted. For each file's encryption, there is a symmetric key K(file). K(file) is encrypted by public key A and can be decrypted by private key B only.

The key point here, I think, is that you can use different passcodes to decrypt private key B, similar to LUKS encryption. For example, key C (the real key for decrypting key B), has several copies and each one is encrypted by your passcode or one of your app-passwords. In this case, your passcode and your app-passwords have no difference in decrypting files.

  • After reading about LUKS encryption, and also Android device encryption I think that you're right. You just have to encrypt multiple copies of the private key, each with a specific passphrase. Thanks :)
    – oXis
    Commented Oct 1, 2019 at 9:08

The authentication mechanism is separate from the End-to-End Encryption. The private key for E2E is encrypted and decrypted with the mnemonic, a 12 word passphrase. This is never sent to the server, you have to add it manually to each of your clients (we will add qr codes to make that easier in the future). It is stored in the software keychain on each device and you can let each device show you the passphrase when you need to add another device.

We also recommend you write it down.

  • 2
    You're talking about End-to-end Encryption, my question is about server-side encryption. Still, thanks for the explanation :)
    – oXis
    Commented Aug 25, 2018 at 10:24
  • If you work for the vendor, it would be nice if you specifically mention that.
    – schroeder
    Commented Aug 25, 2018 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .