A ncx file can be declared encrypted, but stay un-encrypted, as it should.

[llemeurfr]

NCX files must not be encrypted. They are identified by their mime-type.

In the sample we got, the opf contains a valid value:

<item href="ncx.ncx" id="ncx" media-type="application/x-dtbncx+xml"/>

And the ncx file is not encrypted.

Still, encryption.xml contains an entry for this file, which is wrong.