-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
added the encryption details page which decribes the server-side encr… #1571
Conversation
…yption implementation of the default encryption module Signed-off-by: Kenny <k.niehage@syseleven.de>
I had a look at the text. It's definitely a good idea to document this topic, so thank you for your effort. My knowledge about the encryption mechanism in nextcloud is limited to the encryption wrapper, and as far as that mechanism is concerned the text seems correct, with just one omission that you may want to adress. |
… older encryption schemes Signed-off-by: Kenny <k.niehage@syseleven.de>
@jknockaert Thanks for the feedback. I added a note to the introduction that describes that previous versions of Nextcloud implemented slightly different encryption schemes and that these files may till be around. |
@rullzer @MorrisJobke @schiessle @jknockaert Hi, this PR is now stalled for a over a month. Is there something we can help with to get this PR approved? |
cc @nextcloud/encryption |
Maybe you could also add a reference to E2E to fix #1275. |
Oh and maybe a note that app data (calendar, contacts, chats etc.) are stored in the database and not encrypted. |
The server-side encryption is a totally different concept compared to the client-side E2E encryption. So "referencing" it just to fix that issue doesn't seem like a viable solution. |
IMHO the document already goes into great detail what gets encrypted by the server-side encryption. From the details it should become obvious that data within the database do not get encrypted. :) |
@rullzer @MorrisJobke @schiessle @jknockaert Another month has gone by. |
@rullzer @MorrisJobke @schiessle @jknockaert Hi there, another month has passed. Did you find the time to review this pull request? 🙂 |
@yahesh unfortunately Morris is unavailable and everyone is completely booked! Maybe @J0WI and @jknockaert can help and review? :) |
Key type: recovery key | ||
---------------------- | ||
|
||
The recovery key is used to provide a restore mechanism in cases where the user key encryption is enabled and users have lost their passwords. The recovery key is protected by a recovery password that the server administrator should store securely. The advantage of the recovery key is that files can be recovered but has the disadvantage that the server administrator is able to decrypt user files without knowing any user password. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The recovery key is only used if user keys are activated and no master key is used. Both, the admin and the user must enable the recovery key:
https://docs.nextcloud.com/server/stable/admin_manual/configuration_files/encryption_configuration.html#enabling-users-file-recovery-keys
Key type: user key | ||
------------------ | ||
|
||
While the user key encryption has been enabled by default in older versions of Nextcloud it now has to be enabled explictly in newer versions including Nextcloud 16 by calling ``./occ encryption:disable-master-key``. With user key encryption enabled all users have their own user keys that are used to secure the files handled by Nextcloud. The user keys are protected by the user passwords. The advantage is that the server administrator is not able to decrypt user files without knowing any user password - unless the file is publicly shared or a recovery key is defined - but has the disadvantage that files are permanently lost if the users forget their user passwords - unless the files are (publicly) shared or a recovery key is defined. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While the user key encryption has been enabled by default in older versions of Nextcloud it now has to be enabled explictly in newer versions including Nextcloud 16 by calling ``./occ encryption:disable-master-key``. With user key encryption enabled all users have their own user keys that are used to secure the files handled by Nextcloud. The user keys are protected by the user passwords. The advantage is that the server administrator is not able to decrypt user files without knowing any user password - unless the file is publicly shared or a recovery key is defined - but has the disadvantage that files are permanently lost if the users forget their user passwords - unless the files are (publicly) shared or a recovery key is defined. | |
While the user key encryption has been enabled by default in older versions of Nextcloud it now has to be enabled explicitly in newer versions including Nextcloud 16 by calling ``./occ encryption:disable-master-key``. With user key encryption enabled all users have their own user keys that are used to secure the files handled by Nextcloud. The user keys are protected by the user passwords. The advantage is that the server administrator is not able to decrypt user files without knowing any user password - unless the file is publicly shared or a recovery key is defined - but has the disadvantage that files are permanently lost if the users forget their user passwords - unless the files are (publicly) shared or a recovery key is defined. |
(explictly => explicitly)
Signed-off-by: Kenny <k.niehage@syseleven.de>
@J0WI I introduced your recommended changes. :) |
Thanks for your first pull request and welcome to the community! Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/documentation/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22 |
Thanks @yahesh 👍 |
/backport to stable17 |
/backport to stable16 |
backport to stable17 in #1718 |
backport to stable16 in #1719 |
…yption implementation of the default encryption module
As was advised in the nextcloud/server issue #16419 we provide the description of the server-side encryption as a ReStructuredText document. As this document will likely have another target audience than the existing "Encryption configuration" page we created a separate "Encryption details" page.