"Invalid private key for encryption app." I did not change my password

Since yesterday night I get the following popup

Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files.

I did not change anything from the day before where the synchronization/access was still working.

I am now not able to access my files anymore. This happens only for one user, I have tried with other users, they do not have this problem.

I tried to decrypt the data with the occ tool but could not find the recovery key at first. Now the decrypt tools does not start anymore since it says that encryption is not enabled.

I hope you can help me to recover my data.

Nextcloud version : 20.0.7
Operating system and version : Ubuntu 20.04.2 LTS
nginx version: 1.18.0-0ubuntu1
PHP version : 7.4

The output of my Nextcloud log:

Fatal	webdav	Sabre\DAV\Exception\ServiceUnavailable: Encryption not ready: Private Key missing for user: please try to log-out and log-in again

    /var/www/owncloud/apps/dav/lib/Connector/Sabre/File.php - line 436:

    OCA\DAV\Connector\Sabre\File->convertToSabreException()

    /var/www/owncloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php - line 90:

    OCA\DAV\Connector\Sabre\File->get()

    /var/www/owncloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php - line 89:

    Sabre\DAV\CorePlugin->httpGet()

    /var/www/owncloud/3rdparty/sabre/dav/lib/DAV/Server.php - line 474:

    Sabre\DAV\Server->emit()

    /var/www/owncloud/3rdparty/sabre/dav/lib/DAV/Server.php - line 251:

    Sabre\DAV\Server->invokeMethod()

    /var/www/owncloud/3rdparty/sabre/dav/lib/DAV/Server.php - line 319:

    Sabre\DAV\Server->start()

    /var/www/owncloud/apps/dav/lib/Server.php - line 332:

    Sabre\DAV\Server->exec()

    /var/www/owncloud/apps/dav/appinfo/v2/remote.php - line 35:

    OCA\DAV\Server->exec()

    /var/www/owncloud/remote.php - line 167:

    require_once("/var/www/ow ... p")

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

$CONFIG = array (
  'instanceid' => 'xx',
  'passwordsalt' => 'xx',
  'secret' => 'xx',
  'trusted_domains' =>
  array (
    0 => 'xx',
    1 => 'xx',
    2 => 'xx',
  ),
  'datadirectory' => '/var/lib/owncloud/data',
  'overwrite.cli.url' => 'https://xx.org',
  'dbtype' => 'mysql',
  'version' => '20.0.7.1',
  'logtimezone' => 'UTC',
  'installed' => true,
  'mail_from_address' => 'cloud',
  'mail_smtpmode' => 'smtp',
  'mail_domain' => 'xx.org',
  'defaultapp' => 'apporder',
  'theme' => '',
  'loglevel' => 0,
  'maintenance' => false,
  'appstore.experimental.enabled' => true,
  'trashbin_retention_obligation' => 'auto',
  'updater.server.url' => 'https://updates.nextcloud.com/updater_server/',
  'dbname' => 'nextcloud',
  'dbhost' => '127.0.0.1',
  'dbuser' => 'nextcloud_user',
  'dbpassword' => 'xx',
  'updater.release.channel' => 'stable',
  'mysql.utf8mb4' => true,
  'ldapIgnoreNamingRules' => false,
  'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory',
  'encryption.legacy_format_support' => false,
  'encryption.key_storage_migrated' => false,
  'auth.webauthn.enabled' => true,
  'twofactor_enforced' => 'true',
  'twofactor_enforced_groups' =>
  array (
    0 => 'admin',
  ),
  'twofactor_enforced_excluded_groups' =>
  array (
  ),
'mail_smtpauth' => 1,
  'mail_sendmailmode' => 'smtp',
  'mail_smtpauthtype' => 'PLAIN',
  'mail_smtphost' => 'xx',
  'mail_smtpport' => '465',
  'mail_smtpname' => 'xx',
  'mail_smtppassword' => 'xx',
  'mail_smtpsecure' => 'ssl',

I found the solution! I recently turned off the legacy encryption. I did this after following the guide that said that I should run occ encryption:scan:legacy-format to check if I could turn off the legacy encryption, which the command confirmed that I could turn off. This resulted in the error above.
I solved it by turning the legacy encryption back on.

 'encryption.legacy_format_support' => false

back to

 'encryption.legacy_format_support' => true,
1 Like

Thank you! I just had the exact same experience: command-line check says that I can safely turn of legacy-encryption. But then, no one can access their files anymore… So I re-enabled the old encryption.