8

I have all my data encrypted on my laptop. All the backup hard drives are also encrypted. I know all the keys by heart and I could pick up any disk, enter the password and restore everything with it. As far as backup is concerned, this is nice.

But what happens if I have an accident and cannot remember the password? My whole digital live would be locked away and there would be no way to bring it back.

Also if I should pass away my relatives would have no way to get my accumulated data. There are vacation photographs they would probably want to have. And things like utility and phone contracts are probably very handy in order to sort things out afterwards. My parents might not even know exactly what I have contracts with (e.g. Spotify).

The data that I have is harmless and legal. So I am not trying to hide any crime, I just do not want somebody to steal my laptop (for the hardware) to obtain access to my emails and such. Same goes for my house, I do not want a thief to take over all my accounts after a physical theft. So its not really secret, it is just private data.

One way I thought of doing this is to give my parents some long random key printed out on paper to store in their house. Then I add this key as a secondary key to the encrypted hard drives. They cannot directly access the data as the computers are in my house but one could quickly get access if something nasty happens.

As my parents and I mutually exchanged house keys it would be technically possible to break into one house and find everything you need to get into the other house. But they would have to know to look for the printed keys at my parent's house. I find this rather unrealistic for the thief-for-money and if some adversary like this is up my back I guess I have bigger problems with online attacks.

Is this a good scheme to provide a backdoor to my encrypted files or is there some better way to do this?

(I am posting this with a new user as I do not want to give anyone ideas when searching for my name.)

4
  • 8
    I think the term key escrow may be more specific than backdoor. A backdoor can also refer to tweaks in the encryption algorithm to allow parties to break into it. That's not what you're discussing. Jan 9, 2016 at 18:32
  • 2
    How about a safety deposit box? Jan 9, 2016 at 18:38
  • Fyi: Gmail has a system which will send an email after a specified time period to a certain other email if the email address is not accessed for a certain amount of time (e.g. 3 months). Putting your parent's email address and the entire secret, or part of the secret, into that will guarantee that they can access it after some time. It is somewhat risky if someone gets access to your email, but it usually is already very very bad due to the fact everyone can reset almost every account you have using just your email.
    – Sumurai8
    Jan 9, 2016 at 21:51
  • How about not encrypting the backups and storing them in a physically safe location. Your mobile computer is at the greatest risk, so encrypting it makes sense. Apr 12, 2016 at 14:51

2 Answers 2

6

Keeping the keys with your parents as plan to do seems safe enough. It is indeed unlikely that someone would break into their house, then yours, just to get your data. The most likely disaster scenario is that a burglar breaks into their house, finds your house keys, and visits your house next just because they now have the house keys - AND find the printed papers and the disk, AND decide to use it when they get back in their lair. But the burglar is not likely to type in a long printed key.... although they might try it, to see if it revealed credit card numbers.

You could perhaps mitigate this risk. Your parents probably have an alarm system, so maybe that could be used to warn you also when a break-in happens.

There are a few other solutions, but since the assumption is that you are no longer be able to find the data yourself, they all rely on trusted third parties.

  • A notary. You would put the keys in a box, either on paper or on a memory stick. The notary would keep the box. The box itself could be locked, or in the notary's safe, or both... whatever the notary and you agree on.

  • An n-out-of-m key scheme. Several of your friends/relatives get a partial key. You would use n-out-of-m because something could happen to one of them, and you'd still want them to be able to reconstruct the key if not all of them were able to participate.

1

Add a second key, split it into multiple parts, and give the parts to different relatives (preferably with some level of redundancy, in case one of them loses their copy). Say 3-5 parts spread out over 6-15 relatives. Houses burn down, rats eat papers, things get lost. Check with them once a year to make sure they still have their copy.

Clearly note on the paper with the key what it is, which part of the key it is, how to join the parts together, what algorithm the encryption uses, where the encrypted data is and any other information they might need to access your files. Make sure they can decrypt this without your help, maybe by asking someone who "knows computers".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .