MASTER KEY STORAGE CODE
MASTER KEY STORAGE PASSWORD

User private key: $username.'/files_encryption/OC_DEFAULT_MODULE/'.$username.'.privateKey' Recovery private key: 'files_encryption/OC_DEFAULT_MODULE/recoveryKey_'.$random.'.privateKey' Public sharing private key: 'files_encryption/OC_DEFAULT_MODULE/pubShare_'.$random.'.privateKey' Master private key: 'files_encryption/OC_DEFAULT_MODULE/master_'.$random.'.privateKey' The locations of private key files depend on their key type: 'HBEGIN:cipher:AES-256-CTR:keyFormat:hash:HEND'.

MASTER KEY STORAGE CODE

Furthermore a hexadecimally encoded message authentication code of 64 bytes is calculated (denoted as $signature). For the encryption an initialization vector of 16 bytes is selected (denoted as $iv). The RSA private key that is represented in PEM format is encrypted and Base64 encoded (denoted as $encryption).

MASTER KEY STORAGE PASSWORD

The RSA private key is encrypted and signed with a password and stored in a format that is specific to the Nextcloud encryption module. Private key files contain RSA private keys that are used to decrypt/unseal the share key files. User public key: $username.'/files_encryption/OC_DEFAULT_MODULE/'.$username.'.publicKey' Recovery public key: 'files_encryption/OC_DEFAULT_MODULE/recoveryKey_'.$random.'.publicKey' Public sharing public key: 'files_encryption/OC_DEFAULT_MODULE/pubShare_'.$random.'.publicKey' Master public key: 'files_encryption/OC_DEFAULT_MODULE/master_'.$random.'.publicKey' The locations of public key files depend on their key type: Public key files are stored in PEM format. Public key files contain RSA public keys that are used to encrypt/seal the share key files. This method cannot be used with SAML authentication, because Nextcloud does not get a hold of any credentials whatsoever and therefore cannot use any users’ passwords for encryption. The advantage is that the server administrator is not able to decrypt user files without knowing any user password - unless the file is publicly shared or a recovery key is defined - but has the disadvantage that files are permanently lost if the users forget their user passwords - unless the files are (publicly) shared or a recovery key is defined. The user keys are protected by the user passwords. With user key encryption enabled all users have their own user keys that are used to secure the files handled by Nextcloud. In older versions of Nextcloud this had been enabled by default. User key encryption needs to be explicitly activated by calling. The advantage of the recovery key is that files can be recovered but has the disadvantage that the server administrator is able to decrypt user files without knowing any user password.

The recovery key is protected by a recovery password that the server administrator should store securely. The recovery key can then be used to restore files when users have lost their passwords. The recovery key is used to provide a restore mechanism in cases where the user key encryption is enabled, where the administrator has enabled the recovery key feature and the user has opted into using the recovery key feature. The advantage of the public sharing key is that it is independent of the selected encryption mode so that Nextcloud is able to provide publicly shared files to outside parties. The public sharing key is protected by a password that can be generated by the server administrator. The public sharing key is used to secure files that have been publicly shared. The advantage of the master key encryption is that the encryption is transparent to the users but has the disadvantage that the server administrator is able to decrypt user files without knowing any user password. The master key is protected by a password that can be generated by the server administrator. With master key encryption enabled there is one central key that is used to secure the files handled by Nextcloud. This is the default encryption mode in Nextcloud. However, files that have been encrypted in Nextcloud versions 15 and lower may have slightly different structures.

Master key storage