Add encryption support

[sbernhard]

Currently, encryption isn't supported for group folders. Group folders are a highly used feature if you use nextcloud in groups - which is, a very common scenario.

To finish the story of encrypt all files and end-to-end encryption, it would really make sense to support encryption for group folders, too!

[scoopex]

Yes, encryption for group folders should be a must have.
Users of the plugin should be warned when they try to use encrypted group folders when that is not supported.
Otherwise they consider the software to be be "unstable" - that's bad for this great project :-)

[c0d3m4tt3rz]

Is anything in particular stopping the development of this? Can we contribute anything? Is NC missing some core feature which makes this impossible?

[agentlibre]

Could we have an official comment on this issue please ? Groupfolders is officially featured. Encryption 🔑 seems so critical for sovereign data hosting; it is beyond my comprehension that this issue has not been addressed at a higher priority level. 😮

Is there some alternative planning for group folders / sharing? What is there that we do not see here? 🧐

NB: not judging, just truly confused as a fervent supporter of NextCloud 🥺

[juliusknorr]

Nothing planned in that regard. I also question the actual use case of using server side encryption which was primarily designed for external storages. In the end the keys and secret (when using a master key) are stored on the same storage so anyone who has access to those can also decrypt the files.

[meznak]

I also question the actual use case ... primarily designed for external storages.

Use case: I run NC in AWS, and would like to use S3 for storage. I have users who want to use group folders, but I don't trust the connection between my instance and S3. These features really shouldn't be mutually exclusive.

I understand this is a tricky problem to solve, but users have been asking for this for four years, and the need seems pretty clear cut to me.

[c0d3m4tt3rz]

I also question the actual use case of using server side encryption which was primarily designed for external storages

There are many use cases. External storage can be mounted locally. Protecting a single master key is a lot easier than an entire directory structure. And let's not forget the simple fact that NC supports locally encrypted storage, and that it's only the groupfolders feature that doesn't.

Some of the people in this thread have been trying to understand what the technical difficulties with this issue are. Some of us are willing to put in the effort to help get this off the ground. But this attitude of ignoring the problem for well over a year (and presumably longer) doesn't seem very constructive. We want to help, but we need a place to start.

[agentlibre]

@juliushaertl Thank you for your prompt reply; much appreciated 🙌

Having the public & secret keys at the same location is not the only design possible though, is it? I'm no expert but I believe a program installed on another server could be used for authentication / master key validation.

[patrickuhlmann]

I think if it is not supported at least it should not fail when moving files from a user share to a groupfolder. In my case the user share was encrypted and after moving the file to the group folder (using the web interface), the encrypted file was in the groupfolder but no keymaterial available anymore. The file was broken and I needed to recover from a backup.

At least encrypted files should be decrypted before moving to a group folder!

[kleener]

What is the status here, since encryption can be activated in the latest release?
https://github.com/nextcloud/groupfolders/releases/tag/v12.0.2

[ghost]

Still an issue on NC 25.0.1 with groupfolder enabled and encryption on

[kleener]

in the following commit it looks like you still have to enable encryption for groupfolders:
2df8760

But I have not yet found anything about this in the documentary.

[x-merlin-x]

Any news on this one year later?

[joshtrichards]

Fixed in #2057

Off by default, but activated with the following command:

occ config:app:set groupfolders enable_encryption --value="true"

README doc addition in #2658 (pending).