nextcloud / nextcloud/richdocuments

Cannot open documents due to MultiKeyDecryptException

Open
#2,793 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug integration: encryption (server-side)
Dominant language
JavaScript
Stars
453
Forks
147
Avg merge
14h 54m
Merged PRs (30d)
83

Description

Describe the bug
Cannot open documents due to MultiKeyDecryptException.

To Reproduce
Steps to reproduce the behavior:

  1. Create a new ODT document
  2. Attempt to open said document
  3. After a while, the prompt says there was a problem and to try again later.

Expected behavior
The document should open.

Client details:

  • OS: MacOS
  • Browser: Brave
  • Device: Desktop

Server details

Operating system: Debian 11

Web server: Docker AiO Latest

Database: PostgreSQL 14.6

PHP version: 8.0.27

Nextcloud version: 25.0.3

Version of the richdocuments app 7.1.0

Version of Collabora Online Docker AiO Latest

Storage: Primary setup as an S3-compatible bucket. This setup seems to be working just fine.

Server-side Encryption: Enabled, with default encryption module

Logs
Nextcloud log (data/nextcloud.log)
{"reqId":"PXnT1ZW9sT2Rv4EaYNGy","level":3,"time":"2023-02-05T14:32:46+00:00","remoteAddr":"85.186.55.184","user":"andrei","app":"richdocuments","method":"GET","url":"/apps/richdocuments/index?fileId=14740&requesttoken=<TOKEN>&path=%2FTest.odt","message":"multikeydecrypt with share key failed:error:0407109F:rsa routines:RSA_padding_check_PKCS1_type_2:pkcs decoding error","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"25.0.3.2","exception":{"Exception":"OCA\\Encryption\\Exceptions\\MultiKeyDecryptException","Message":"multikeydecrypt with share key failed:error:0407109F:rsa routines:RSA_padding_check_PKCS1_type_2:pkcs decoding error","Code":0,"Trace":[{"file":"/var/www/html/apps/encryption/lib/KeyManager.php","line":479,"function":"multiKeyDecrypt","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/encryption/lib/Crypto/Encryption.php","line":405,"function":"getFileKey","class":"OCA\\Encryption\\KeyManager","type":"->","args":["*** sensitive parameters replaced ***","master_411f946f"]},{"file":"/var/www/html/custom_apps/richdocuments/lib/Controller/DocumentController.php","line":196,"function":"update","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":225,"function":"index","class":"OCA\\Richdocuments\\Controller\\DocumentController","type":"->","args":["14740","/Test.odt"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":133,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Richdocuments\\Controller\\DocumentController"},"index"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":172,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Richdocuments\\Controller\\DocumentController"},"index"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":298,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Richdocuments\\Controller\\DocumentController","index",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},["richdocuments.document.index"]]},{"file":"/var/www/html/lib/base.php","line":1047,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/apps/richdocuments/index"]},{"file":"/var/www/html/index.php","line":36,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/apps/encryption/lib/Crypto/Crypt.php","Line":713,"Hint":"multikeydecrypt with share key failed:error:0407109F:rsa routines:RSA_padding_check_PKCS1_type_2:pkcs decoding error","CustomMessage":"--"}}
Browser log

N/A

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the logged call chain at apps/encryption/lib/KeyManager.php:479 and apps/encryption/lib/Crypto/Encryption.php:405, then inspect richdocuments/lib/Controller/DocumentController.php:196. Reproduce opening an encrypted ODT with the reported S3-compatible storage and Collabora setup. Done means the document opens without MultiKeyDecryptException, with a regression test covering the failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, php, postgresql
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.