0

I've been looking around how server-side encryption works. Thanks to the nextcloud doc I understand the implementation.

Basically, when you first log in a key pair is created, and the private key is encrypted using a key derived from the password of the user. When a new file is a created, a symmetric key is used and that key is encrypted with the public key and can only be decrypted with the private key.

When you want to read that file, you log in, the private key is decrypted by the key derived from the password (and stored in memory), then the symmetric key is decrypted (then you can decrypt the file).

But, I am using two-factor authentication on the server, with a Yubikey. So when I want a desktop client to connect to my nextcloud I use an app password. How is the private key decrypted when I'm using nextcloud desktop client with an app password? Furthermore, the user password is not stored in plain text. Maybe the app password is derived from the user password, but how?

Edit: I'm not looking at how the technique is implemented in Nextcloud in particular, just at a general explanation on how it can be done.

-1

The authentication mechanism is separate from the End-to-End Encryption. The private key for E2E is encrypted and decrypted with the mnemonic, a 12 word passphrase. This is never sent to the server, you have to add it manually to each of your clients (we will add qr codes to make that easier in the future). It is stored in the software keychain on each device and you can let each device show you the passphrase when you need to add another device.

We also recommend you write it down.

  • 2
    You're talking about End-to-end Encryption, my question is about server-side encryption. Still, thanks for the explanation :) – oXis Aug 25 '18 at 10:24
  • If you work for the vendor, it would be nice if you specifically mention that. – schroeder Aug 25 '18 at 19:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.