Authenticated ciphertext could not be decoded

[tobiasKaminsky]

Describe the bug

{
  "reqId": "ObUipdnIDrRtHVTcJDyU",
  "level": 3,
  "time": "2024-12-10T09:51:59+00:00",
  "remoteAddr": "2a02:8071:64e0:7bc0:2f86:72c1:6a64:1cb5",
  "user": "admin",
  "app": "index",
  "method": "GET",
  "url": "/settings/apps",
  "message": "Authenticated ciphertext could not be decoded.",
  "userAgent": "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0",
  "version": "31.0.0.6",
  "exception": {
    "Exception": "Exception",
    "Message": "Authenticated ciphertext could not be decoded.",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/lib/private/Security/Crypto.php",
        "line": 102,
        "function": "decryptWithoutSecret",
        "class": "OC\\Security\\Crypto",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/apps/app_api/lib/DeployActions/DockerActions.php",
        "line": 626,
        "function": "decrypt",
        "class": "OC\\Security\\Crypto",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/html/apps/app_api/lib/Service/ExAppsPageService.php",
        "line": 46,
        "function": "initGuzzleClient",
        "class": "OCA\\AppAPI\\DeployActions\\DockerActions",
        "type": "->"
      },
      {
        "file": "/var/www/html/apps/settings/lib/Controller/AppSettingsController.php",
        "line": 97,
        "function": "provideAppApiState",
        "class": "OCA\\AppAPI\\Service\\ExAppsPageService",
        "type": "->"
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 200,
        "function": "viewApps",
        "class": "OCA\\Settings\\Controller\\AppSettingsController",
        "type": "->"
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 114,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/html/lib/private/AppFramework/App.php",
        "line": 161,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/html/lib/private/Route/Router.php",
        "line": 306,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/var/www/html/lib/base.php",
        "line": 1019,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/var/www/html/index.php",
        "line": 24,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/var/www/html/lib/private/Security/Crypto.php",
    "Line": 114,
    "message": "Authenticated ciphertext could not be decoded.",
    "exception": {},
    "CustomMessage": "Authenticated ciphertext could not be decoded."
  }
}

Steps/Code to Reproduce

use latest master
access apps

Expected Results

no error

Actual Results

/

Setup configuration

/

[andrey18106]

@tobiasKaminsky I think it is related to the recent changes to encrypt the secrets, is this migration executed on your instance: https://github.com/nextcloud/app_api/blob/main/lib/Migration/Version5000Date20241120135411.php ( occ migrations:status app_api)?

[tobiasKaminsky]

No. I did not migrated anything.
But also:

$ ./occ migrations:status app_api

                                               
  Command "migrations:status" is not defined.  
                                               
  Did you mean one of these?                   
      encryption:status                        
      migrations:preview                       
      twofactorauth:state   

[andrey18106]

No. I did not migrated anything. But also:

$ ./occ migrations:status app_api

                                               
  Command "migrations:status" is not defined.  
                                               
  Did you mean one of these?                   
      encryption:status                        
      migrations:preview                       
      twofactorauth:state   

This command is available only with debug => true, you can set it via NC_<config_name> environment: NC_debug=true php occ migrations:status app_api.

There is was missing app version bump so the migration is not triggered to execute with app update.
Since app_api shipped and main branch is dev currently for NC31 we don't bump version so just run: occ migrations:execute app_api 5000Date20241120135411 to execute new migration to encrypt secret values and it should work then.

[oleksandr-nc]

We should do the same as in Spreed(Talk) - by default the current version in the main branch is with the "devХ" suffix and then we can bump it.

When releasing a new version of the server, we remove this prefix and start counting from the zero minor version, to be with server repo in sync.

We cannot bump version 5.0.0 here now (with the dev suffix it will be a smaller version, I think), initially we had to add the suffix.

Now we can only add the suffix when NC31 comes out, and the next version in the main branch here should be 6.0.0-dev.0

[tobiasKaminsky]

Since app_api shipped and main branch is dev currently for NC31 we don't bump version so just run: occ migrations:execute app_api 5000Date20241120135411 to execute new migration to encrypt secret values and it should work then.

This solved it 🎉

[PlugNPush]

Hey, I have been encountering this issue for a very long time and the migration did not help me, am I missing anything else?

www-data@webserver:~/cloud$ NC_debug=true php occ migrations:status app_api
    >> App:                                                app_api
    >> Version Table Name:                                 oc_migrations
    >> Migrations Namespace:                               OCA\AppAPI\Migration
    >> Migrations Directory:                               /var/www/cloud/apps/app_api/lib/Migration
    >> Previous Version:                                   5000Date20250109163201
    >> Current Version:                                    032001Date20250115164140
    >> Next Version:                                       Already at latest migration step
    >> Latest Version:                                     032001Date20250115164140
    >> Executed Migrations:                                27
    >> Executed Unavailable Migrations:                    27
    >> Available Migrations:                               26
    >> New Migrations:                                     26
    >> Pending Migrations:                                 None
www-data@webserver:~/cloud$ NC-debug=true php occ migrations:execute app_api 5000Date20241120135411
NC-debug=true: command not found
www-data@webserver:~/cloud$ NC_debug=true php occ migrations:execute app_api 5000Date20241120135411
www-data@webserver:~/cloud$ php occ encryption:encrypt-all


You are about to encrypt all files stored in your Nextcloud installation.
Depending on the number of available files, and their size, this may take quite some time.
Please ensure that no user accesses their files during this time!
Note: The encryption module you use determines which files get encrypted.

Do you really want to continue? (y/n) y


Encrypt all files with the Default encryption module
====================================================


Use master key to encrypt all files.

In Storage.php line 264:
                         
  Could not decrypt key  
                         

In Crypto.php line 114:
                                                  
  Authenticated ciphertext could not be decoded.  
                                                  

encryption:encrypt-all

[andrey18106]

Hello, @PlugNPush!

Do you have any Deploy daemons configured? Mentioned migration (https://github.com/nextcloud/app_api/blob/main/lib/Migration/Version5000Date20241120135411.php#L35-L56) is responsible for encryption of deploy_config.haproxy_password in ex_apps_daemons table. If it is related you could revert its value to original un-encrypted and execute migration again. If it doesn't help then maybe it is another app.

Do you have any ExApp that have encrypted configs?

[PlugNPush]

Hello, @PlugNPush!

Do you have any Deploy daemons configured? Mentioned migration (https://github.com/nextcloud/app_api/blob/main/lib/Migration/Version5000Date20241120135411.php#L35-L56) is responsible for encryption of deploy_config.haproxy_password in ex_apps_daemons table. If it is related you could revert its value to original un-encrypted and execute migration again. If it doesn't help then maybe it is another app.

Do you have any ExApp that have encrypted configs?

I'm not sure. I am simply running nextcloud from a folder in my /var/www/ and using Apache to serve it. One thing I know is that this is a quite old instance. It started with ownCloud 8, 9. Then I transferred it to Nextcloud in late 2016 -- I believe I did a database reset at the time but my current database still has the oc_ prefix in the table names. From there I kept Nextcloud updated, sometimes skipping major versions sometimes using the web updater with transit through all versions to jump ahead. I wonder if I should just download my folders and burn the whole instance down to solve the various issues that I have with it 😅

[andrey18106]

Hello, @PlugNPush!
Do you have any Deploy daemons configured? Mentioned migration (https://github.com/nextcloud/app_api/blob/main/lib/Migration/Version5000Date20241120135411.php#L35-L56) is responsible for encryption of deploy_config.haproxy_password in ex_apps_daemons table. If it is related you could revert its value to original un-encrypted and execute migration again. If it doesn't help then maybe it is another app.
Do you have any ExApp that have encrypted configs?

I'm not sure. I am simply running nextcloud from a folder in my /var/www/ and using Apache to serve it. One thing I know is that this is a quite old instance. It started with ownCloud 8, 9. Then I transferred it to Nextcloud in late 2016 -- I believe I did a database reset at the time but my current database still has the oc_ prefix in the table names. From there I kept Nextcloud updated, sometimes skipping major versions sometimes using the web updater with transit through all versions to jump ahead. I wonder if I should just download my folders and burn the whole instance down to solve the various issues that I have with it 😅

Are you just enabling encryption for the first time or it was all the time? Maybe you have legacy encryption or you have missing master/user keys to decrypt that is why it fails.
Do you have exact Nextcloud log entry with this error from where it comes from?
You can check similar issues in nextcloud/server, e.g. nextcloud/server#23302 and nextcloud/server#24240

[PlugNPush]

It was enabled and disabled multiple times over the years (at least 5?). Regarding the legacy encryption, here is the command output:

> php occ encryption:scan:legacy-format
Scanning all files for legacy encryption
...
All scanned files are properly encrypted. You can disable the legacy compatibility mode.

When I do the occ encryption:encrypt-all, I get the error mentioned above in my terminal.

When I go in my personal space online, I get a warning saying that I need to update my personal key. However, after putting the "old" and new password (it has never changed) in the Settings, the index.php/apps/encryption/ajax/updatePrivateKeyPassword call in the console reports an error 503 with some HTML and "Private Key missing for user: myusername" inside. Really not sure what I should do here...

[andrey18106]

It was enabled and disabled multiple times over the years (at least 5?). Regarding the legacy encryption, here is the command output:

> php occ encryption:scan:legacy-format
Scanning all files for legacy encryption
...
All scanned files are properly encrypted. You can disable the legacy compatibility mode.

When I do the occ encryption:encrypt-all, I get the error mentioned above in my terminal.

When I go in my personal space online, I get a warning saying that I need to update my personal key. However, after putting the "old" and new password (it has never changed) in the Settings, the index.php/apps/encryption/ajax/updatePrivateKeyPassword call in the console reports an error 503 with some HTML and "Private Key missing for user: myusername" inside. Really not sure what I should do here...

Did you disable legacy encryption support like in linked comments (nextcloud/server#27501 (comment), nextcloud/server#8546 (comment)), it looks like with upgrades from old setup there is a problematic migration from old encryption, but more details and investigation is needed.
Do not forget for backup before trying to re-encrypt.

[PlugNPush]

Is there a way to reset the master key? My files are currently decrypted, so I do not care about loosing stuff in the process.

[PlugNPush]

Seems like adding 'encryption.key_storage_migrated' => false to my config did the trick!