I've been looking around how server-side encryption works. Thanks to the nextcloud doc I understand the implementation.
Basically, when you first log in a key pair is created, and the private key is encrypted using a key derived from the password of the user. When a new file is a created, a symmetric key is used and that key is encrypted with the public key and can only be decrypted with the private key.
When you want to read that file, you log in, the private key is decrypted by the key derived from the password (and stored in memory), then the symmetric key is decrypted (then you can decrypt the file).
But, I am using two-factor authentication on the server, with a Yubikey. So when I want a desktop client to connect to my nextcloud I use an app password. How is the private key decrypted when I'm using nextcloud desktop client with an app password? Furthermore, the user password is not stored in plain text. Maybe the app password is derived from the user password, but how?
Edit: I'm not looking at how the technique is implemented in Nextcloud in particular, just at a general explanation on how it can be done.