Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files

[knut-hildebrandt]

Tip

This issue can have multiple potential causes.

• Please see this comment which contains a write-up/overview to help identify your situation.

---

Steps to reproduce

1. enable Default encryption module
2. logout and login again (as recommend)
3. go to Security settings to change password

Expected behaviour

Default encrytion module should be enable and work without problems. No clue why changing password is necessary.

Actual behaviour

At login an error message pops up saying: "Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files"

Trying to change the password is not possible, because an old password that could be entered never has been set. This even holds true for fresh accounts that are set up after enabling Default encryption module.

See discussion here: https://help.nextcloud.com/t/invalid-private-key-for-encryption-app-please-update-your-private-key-password-in-your-personal-settings-to-recover-access-to-your-encrypted-files/27108/13

Server configuration

Operating system:

Web server:
shared hoster
Database:
mysql 5.6.34
PHP version:
5.6
Nextcloud version: (see Nextcloud admin page)
13.0.0
Updated from an older Nextcloud/ownCloud or fresh install:
from 12.0.5
Where did you install Nextcloud from:
updater
Signing status:

Signing status

Login as admin user into your Nextcloud and access 
http://example.com/index.php/settings/integrity/failed 
paste the results here.

"No errors have been found."

</details>

**List of activated apps:**
<details>
<summary>App list</summary>
 Activity
2.6.1

AppOrder
0.4.1

Audio Player
2.2.5

Auditing / Logging
1.3.0

Brute-force settings
1.0.3

Calendar
1.6.0

Collaborative tags
1.3.0

Comments
1.3.0

Contacts
2.1.0

Default encryption module
2.0.0

Deleted files
1.3.0

External storage support
1.4.1

Federation
1.3.0

File sharing
1.5.0

First run wizard
2.2.1

Gallery
18.0.0

Log Reader
2.0.0

Mail
0.7.10

Monitoring
1.3.0

Nextcloud announcements
1.2.0

Notifications
2.1.2

Password policy
1.3.0

PDF viewer
1.2.0

Share by mail
1.3.0

Talk
3.1.0

Tasks
0.9.6

Text editor
2.5.1

Theming
1.4.1

Update notification
1.3.0

Usage survey
1.1.0

Versions
1.6.0

Video player
1.2.0

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration:

Config report

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

or 

Insert your config.php content here. 
Make sure to remove all sensitive content such as passwords. (e.g. database password, passwordsalt, secret, smtp password, …)

<?php
$CONFIG = array (
  'instanceid' => '',
  'passwordsalt' => '',
  'secret' => '',
  'trusted_domains' => 
  array (
    0 => 'nextcloud.domain-name.de',
    1 => 'owncloud.domain-name.de',
  ),
  'datadirectory' => '/home/webpages/provider-name/user-name/nextcloud/data',
  'overwrite.cli.url' => 'https://nextcloud.domain-name.de',
  'dbtype' => 'mysql',
  'version' => '13.0.0.14',
  'dbname' => 'db_abc_1',
  'dbhost' => 'user-name.provider-name-db.de',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'USERxyc',
  'dbpassword' => '',
  'logtimezone' => 'UTC',
  'installed' => true,
  'maintenance' => false,
  'theme' => '',
  'loglevel' => 2,
  'mail_domain' => 'domain-name.de',
  'mail_from_address' => 'mail',
  'mail_smtpmode' => 'smtp',
  'mail_smtpauth' => 1,
  'mail_smtpsecure' => 'ssl',
  'mail_smtpport' => '465',
  'mail_smtphost' => 'mail.provider-name.de',
  'mail_smtpname' => 'mail@domain-name.de',
  'mail_smtppassword' => '',
  'mail_smtpauthtype' => 'PLAIN',
  'updater.release.channel' => 'stable',
);

</details>

**Are you using external storage, if yes which one:** local/smb/sftp/...

3x WebDAV
1 x Unknown: googledrive -> does not work anymore

**Are you using encryption:** yes/no
no
**Are you using an external user-backend, if yes which one:** LDAP/ActiveDirectory/Webdav/...
no
#### LDAP configuration (delete this part if not used)
<details>
<summary>LDAP config</summary>

With access to your command line run e.g.:
sudo -u www-data php occ ldap:show-config
from within your Nextcloud installation folder

Without access to your command line download the data/owncloud.db to your local
computer or access your SQL server remotely and run the select query:
SELECT * FROM oc_appconfig WHERE appid = 'user_ldap';

Eventually replace sensitive data as the name/IP-address of your LDAP server or groups.

</details>

### Client configuration
**Browser:**
Firefox 56
**Operating system:**
Linux
### Logs
#### Web server error log
<details>
<summary>Web server error log</summary>

Insert your webserver log here

</details>

#### Nextcloud log (data/nextcloud.log)
<details>
<summary>Nextcloud log</summary>

Insert your Nextcloud log here

</details>

#### Browser log
<details>
<summary>Browser log</summary>

Insert your browser log here, this could for example include:

a) The javascript console log
b) The network log
c) ...

</details>

[knut-hildebrandt]

Just updated to PHP 7.0.27. The problem prevails.

[MorrisJobke]

cc @nextcloud/encryption

[molotovkazic]

@knut-hildebrandt Thanks for creating this issue. I've done the exact same steps as you to reproduce on my new NC13 deployment.

+1 For this getting picked up and seen by the devs. If it's something stupid simple that I'm doing, then let this fool know.

[molotovkazic]

Looks like #8393 is having same issue, thus linking for visibility

[molotovkazic]

@knut-hildebrandt after searching and searching last night I ended up giving up on it. Come back today and try to give it another go and got things working as my whole goal is to enable E2EE (end-to-end encryption) with my new NC13 deployment on FreeNAS.

So, yesterday I enabled the “Default encryption module” & “End-to-End Encryption” Apps. Went through the process of logout/login and that pesky "Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files" message hit me. I quickly disabled “Default encryption module” & “End-to-End Encryption” Apps to get rid of the error.

I remember reading in a guide that when you enable the encryption feature it must generate the private keys somewhere.

Looking in the NC13 Admin Manual it doesn't show me anything about the keys Nextcloud 13 Administration Manual - Encryption configuration/encryption_configuration.html and I stumbled onto the ownCloud Admin Manual it has a nice section telling you about the keys and where they're stored ownCloud 8.1 Server Administration Manual - Encryption Configuration - Where Keys are Stored

---

This is the new file structure for ownCloud 8.1:

Private public share key:
data/files_encryption/OC_DEFAULT_MODULE/pubShare_.privateKey

Private recovery key:
data/files_encryption/OC_DEFAULT_MODULE/recovery_.privateKey

Public public share key:
data/files_encryption/OC_DEFAULT_MODULE/pubShare_.publicKey

Public recovery key:
data/files_encryption/OC_DEFAULT_MODULE/recovery_.publicKey

File keys for system-wide mount points:
data/files_encryption/keys/<file_path>//OC_DEFAULT_MODULE/fileKey

Share keys for files on a system-wide mount point (one key for the owner and one key for each user with access to the file):
data/files_encryption/keys/<file_path>//OC_DEFAULT_MODULE/.shareKey

Users’ private keys:
data//files_encryption/OC_DEFAULT_MODULE/.privateKey

Users’ public keys:
data//files_encryption/OC_DEFAULT_MODULE/.publicKey

File keys for files owned by the user:
data//files_encryption/keys/<file_path>//OC_DEFAULT_MODULE/fileKey

Share keys for files owned by the user (one key for the owner and one key for each user with access to the file):
data//files_encryption/keys/<file_path>//OC_DEFAULT_MODULE/.shareKey

---

I checked the paths and didn't see that there was anything there. Then it hit me, I never enabled "Server-side encryption".

Went back and made suer that the "Default encryption module” was enabled, turned on "Server-side encryption" and once I did those paths populated with newly generated keys.

Albeit when I checked in the "OC_DEFAULT_MODULE" directory this is what was listed:

---

data/files_encryption/OC_DEFAULT_MODULE # ls -la

master_#####.privateKey
master_#####.publicKey
pubShare_#####.privateKey
pubShare_#####..publicKey

---

I then went back to Apps and enabled “End-to-End Encryption”, downloaded the latest Prerelease Client and started testing E2EE (end-to-end encryption).

Hope this helps shed some light on things and helps folks in the right direction. If there's something that I'm missing or have left out please let me know as I don't' want to be spreading false information and make someone waste their time.

[spackmat]

@shadadougha that's it, thanks.

I enabled server side encryption, then the keys are created. Then I disabled server side encryption via occ encryption:disable again, since I don't want to use it. The Android client then could enable encryption on an empty folder and showed me my passphrase. Works like a charm (even with instant uploads), now waiting for support within the stable Windows client.

[molotovkazic]

@spackmat word, glad that helped. I'm going to have to disable server side encryption as I'm finding some weird issues going on with the E2EE IoS App and suspect this may be causing it.

Also, I'm doing my NC13 deployment in FreeNAS thanks to this guide How to install Nextcloud 13 in FreeNAS with all checks passed updated to use iocage and the occ encryption:disable command didn't work for me at first and I wanted to cross post for visibility that I ended up having to use the following syntax for this to work:

su -m www -c 'php /usr/local/www/apache24/data/nextcloud/occ encryption:disable' and that did it.

Also the guide for Using the occ command is super helpful. If you too are doing a FreeNAS deployment like me below is the proper syntax for running the occ commands

su -m www -c 'php /usr/local/www/apache24/data/nextcloud/occ [COMMAND HERE]'

P.S. Sorry for changing my username that you referenced. Figure it'd be easier to have a coherent presence across Git and other forums I help out with.

[Palulukas]

I am also receiving this error with nextcloud 13.0.5, started with 13.0.4.
Every time I want to update the keys in settings->security (personal) it says "saving..." but nothing happens.
The only way to get this error message away is to disable the default encryption module.

I am really looking forward for a bug fix on that one.

Kind regards
Palulukas