[Bug]: Some shared folders and some user files (not shared) are not decryptable and downloadable

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

We have a case of something similar to what was theoretically fixed here https://github.com/nextcloud/server/issues/39034, however, my case happens on version 27.1.4 and it doesn't happen with every shared folder, additionally, we jumped to this version directly from version 26 several month ago. In addition, we have some files that we also can't decrypt the error is similar, although they were never shared, as in this bug mentioned above. The files affected are pdfs, but also txt and others. So it doesn't seem to be related to Richdocuments used with group folders. We use encryption with the user password without masterkey.

Steps to reproduce

I can't define

Expected behavior

The files should be able to be decrypted and downloaded

Installation method

Community Docker image

Nextcloud Server version

27

Operating system

RHEL/CentOS

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwriteprotocol": "https",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpsecure": "ssl",
        "mail_smtpauth": true,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "27.1.7.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "default_phone_region": "***REMOVED SENSITIVE VALUE***",
        "skeletondirectory": "\/opt\/skeleton",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "maintenance": false,
        "loglevel": 2,
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "theme": ""
    }
}

### List of activated Apps

```shell
Enabled:
  - activity: 2.19.0
  - bruteforcesettings: 2.7.0
  - circles: 27.0.1
  - cloud_federation_api: 1.10.0
  - comments: 1.17.0
  - contactsinteraction: 1.8.0
  - dav: 1.27.0
  - encryption: 2.15.0
  - federatedfilesharing: 1.17.0
  - federation: 1.17.0
  - files: 1.22.0
  - files_pdfviewer: 2.8.0
  - files_reminders: 1.0.0
  - files_rightclick: 1.6.0
  - files_sharing: 1.19.0
  - files_trashbin: 1.17.0
  - files_versions: 1.20.0
  - firstrunwizard: 2.16.0
  - forms: 3.4.6
  - groupfolders: 15.3.5
  - logreader: 2.12.0
  - lookup_server_connector: 1.15.0
  - nextcloud_announcements: 1.16.0
  - notifications: 2.15.0
  - oauth2: 1.15.2
  - password_policy: 1.17.0
  - photos: 2.3.0
  - privacy: 1.11.0
  - provisioning_api: 1.17.0
  - recommendations: 1.6.0
  - related_resources: 1.2.0
  - richdocuments: 8.2.5
  - serverinfo: 1.17.0
  - settings: 1.9.0
  - sharebymail: 1.17.0
  - support: 1.10.0
  - survey_client: 1.15.0
  - suspicious_login: 5.0.0
  - systemtags: 1.17.0
  - text: 3.8.0
  - theming: 2.2.0
  - twofactor_backupcodes: 1.16.0
  - twofactor_totp: 9.0.0
  - updatenotification: 1.17.0
  - user_ldap: 1.17.0
  - user_status: 1.7.0
  - viewer: 2.1.0
  - weather_status: 1.7.0
  - workflowengine: 2.9.0
Disabled:
  - admin_audit: 1.17.0
  - dashboard: 7.7.0 (installed 7.4.0)
  - files_external: 1.19.0

### Nextcloud Signing status

```shell
No errors have been found.

Nextcloud Logs

{"reqId":"<redacted>","level":3,"time":"2024-03-22T13:18:58+00:00","remoteAddr":"<redacted>","user":"<redacted>","app":"no app in context","method":"POST","url":"/ocs/v2.php/apps/files_sharing/api/v1/shares","message":"Exception thrown: OC\\ServerNotAvailableException","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0","version":"27.1.4.1","exception":{"Exception":"OC\\ServerNotAvailableException","Message":"Could not decrypt key","Code":0,"Trace":[{"file":"/var/www/html/lib/private/Encryption/Keys/Storage.php","line":102,"function":"getKey","class":"OC\\Encryption\\Keys\\Storage","type":"->","args":["/<redacted>/files_encryption/keys/files/<redacted>/<redacted>.shareKey"]},{"file":"/var/www/html/apps/encryption/lib/KeyManager.php","line":563,"function":"getFileKey","class":"OC\\Encryption\\Keys\\Storage","type":"->","args":["*** sensitive parameters replaced ***","<redacted>.shareKey","OC_DEFAULT_MODULE"]},{"file":"/var/www/html/apps/encryption/lib/KeyManager.php","line":477,"function":"getShareKey","class":"OCA\\Encryption\\KeyManager","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/encryption/lib/Crypto/Encryption.php","line":421,"function":"getFileKey","class":"OCA\\Encryption\\KeyManager","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/Update.php","line":192,"function":"update","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/Update.php","line":93,"function":"update","class":"OC\\Encryption\\Update","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/HookManager.php","line":35,"function":"postShared","class":"OC\\Encryption\\Update","type":"->","args":[["folder",269400,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","And 8 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/html/lib/private/legacy/OC_Hook.php","line":105,"function":"postShared","class":"OC\\Encryption\\HookManager","type":"::","args":[["folder",269400,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","And 8 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/html/lib/private/Share20/LegacyHooks.php","line":175,"function":"emit","class":"OC_Hook","type":"::","args":["OCP\\Share","post_shared",["folder",269400,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","And 8 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":264,"function":"postShare","class":"OC\\Share20\\LegacyHooks","type":"->","args":[["OC\\EventDispatcher\\GenericEventWrapper"],"OCP\\Share::postShare",["Symfony\\Component\\EventDispatcher\\EventDispatcher"]]},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":239,"function":"doDispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->","args":[[["Closure"],["Closure"],["Closure"]],"OCP\\Share::postShare",["OC\\EventDispatcher\\GenericEventWrapper"]]},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":73,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->","args":[[["Closure"],["Closure"],["Closure"]],"OCP\\Share::postShare",["OC\\EventDispatcher\\GenericEventWrapper"]]},{"file":"/var/www/html/lib/private/EventDispatcher/SymfonyAdapter.php","line":121,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->","args":[["OC\\EventDispatcher\\GenericEventWrapper"],"OCP\\Share::postShare"]},{"file":"/var/www/html/lib/private/Share20/Manager.php","line":836,"function":"dispatch","class":"OC\\EventDispatcher\\SymfonyAdapter","type":"->","args":["OCP\\Share::postShare",["Symfony\\Component\\EventDispatcher\\GenericEvent"]]},{"file":"/var/www/html/apps/files_sharing/lib/Controller/ShareAPIController.php","line":834,"function":"createShare","class":"OC\\Share20\\Manager","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":230,"function":"createShare","class":"OCA\\Files_Sharing\\Controller\\ShareAPIController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":137,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[["OCA\\Files_Sharing\\Controller\\ShareAPIController"],"createShare"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":183,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[["OCA\\Files_Sharing\\Controller\\ShareAPIController"],"createShare"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Files_Sharing\\Controller\\ShareAPIController","createShare",["OC\\AppFramework\\DependencyInjection\\DIContainer"],["ocs.files_sharing.ShareAPI.createShare"]]},{"file":"/var/www/html/ocs/v1.php","line":64,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/ocsapp/apps/files_sharing/api/v1/shares"]},{"file":"/var/www/html/ocs/v2.php","line":23,"args":["/var/www/html/ocs/v1.php"],"function":"require_once"}],"File":"/var/www/html/lib/private/Encryption/Keys/Storage.php","Line":285,"Previous":{"Exception":"Exception","Message":"Authenticated ciphertext could not be decoded.","Code":0,"Trace":[{"file":"/var/www/html/lib/private/Security/Crypto.php","line":134,"function":"decryptWithoutSecret","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/Keys/Storage.php","line":283,"function":"decrypt","class":"OC\\Security\\Crypto","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/Keys/Storage.php","line":102,"function":"getKey","class":"OC\\Encryption\\Keys\\Storage","type":"->","args":["/<redacted>/files_encryption/keys/files/<redacted>/<redacted>.shareKey"]},{"file":"/var/www/html/apps/encryption/lib/KeyManager.php","line":563,"function":"getFileKey","class":"OC\\Encryption\\Keys\\Storage","type":"->","args":["*** sensitive parameters replaced ***","<redacted>.shareKey","OC_DEFAULT_MODULE"]},{"file":"/var/www/html/apps/encryption/lib/KeyManager.php","line":477,"function":"getShareKey","class":"OCA\\Encryption\\KeyManager","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/encryption/lib/Crypto/Encryption.php","line":421,"function":"getFileKey","class":"OCA\\Encryption\\KeyManager","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/Update.php","line":192,"function":"update","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/Update.php","line":93,"function":"update","class":"OC\\Encryption\\Update","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Encryption/HookManager.php","line":35,"function":"postShared","class":"OC\\Encryption\\Update","type":"->","args":[["folder",269400,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","And 8 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/html/lib/private/legacy/OC_Hook.php","line":105,"function":"postShared","class":"OC\\Encryption\\HookManager","type":"::","args":[["folder",269400,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","And 8 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/html/lib/private/Share20/LegacyHooks.php","line":175,"function":"emit","class":"OC_Hook","type":"::","args":["OCP\\Share","post_shared",["folder",269400,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","*** sensitive parameters replaced ***","And 8 more entries, set log level to debug to see all entries"]]},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":264,"function":"postShare","class":"OC\\Share20\\LegacyHooks","type":"->","args":[["OC\\EventDispatcher\\GenericEventWrapper"],"OCP\\Share::postShare",["Symfony\\Component\\EventDispatcher\\EventDispatcher"]]},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":239,"function":"doDispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->","args":[[["Closure"],["Closure"],["Closure"]],"OCP\\Share::postShare",["OC\\EventDispatcher\\GenericEventWrapper"]]},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":73,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->","args":[[["Closure"],["Closure"],["Closure"]],"OCP\\Share::postShare",["OC\\EventDispatcher\\GenericEventWrapper"]]},{"file":"/var/www/html/lib/private/EventDispatcher/SymfonyAdapter.php","line":121,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->","args":[["OC\\EventDispatcher\\GenericEventWrapper"],"OCP\\Share::postShare"]},{"file":"/var/www/html/lib/private/Share20/Manager.php","line":836,"function":"dispatch","class":"OC\\EventDispatcher\\SymfonyAdapter","type":"->","args":["OCP\\Share::postShare",["Symfony\\Component\\EventDispatcher\\GenericEvent"]]},{"file":"/var/www/html/apps/files_sharing/lib/Controller/ShareAPIController.php","line":834,"function":"createShare","class":"OC\\Share20\\Manager","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":230,"function":"createShare","class":"OCA\\Files_Sharing\\Controller\\ShareAPIController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":137,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[["OCA\\Files_Sharing\\Controller\\ShareAPIController"],"createShare"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":183,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[["OCA\\Files_Sharing\\Controller\\ShareAPIController"],"createShare"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Files_Sharing\\Controller\\ShareAPIController","createShare",["OC\\AppFramework\\DependencyInjection\\DIContainer"],["ocs.files_sharing.ShareAPI.createShare"]]},{"file":"/var/www/html/ocs/v1.php","line":64,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/ocsapp/apps/files_sharing/api/v1/shares"]},{"file":"/var/www/html/ocs/v2.php","line":23,"args":["/var/www/html/ocs/v1.php"],"function":"require_once"}],"File":"/var/www/html/lib/private/Security/Crypto.php","Line":146},"CustomMessage":"Exception thrown: OC\\ServerNotAvailableException"}}

### Additional info

_No response_

Start with the logged stack in lib/private/Encryption/Keys/Storage.php, apps/encryption/lib/KeyManager.php, lib/private/Encryption/Update.php, and apps/files_sharing/lib/Controller/ShareAPIController.php. Reproduce the encryption and sharing failure first; the issue provides no reproducible steps or named tests. Done means affected files can be decrypted and downloaded without the reported error.