Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am designing my backup system to Amazon S3 (probably Singapore) and I would like to have all my files strongly encrypted on the server. I use ArchLinux x64. My system will append only once an encrypted folder is upload nothing inside this folder will change. eg. I have documents and each month I will upload a folder for that month.

please note I do not want to use Amazon SSE something about them having the keys to my data feels like a waste of time to me (I may use this in addition to what I describe below).

I wish to do the following (to encrypt the folder foo):

  1. sha512 every file in foo and place the list of hashes in foo/hashes.sha512
  2. dd if=/dev/urandom | tr -dc '[:print:]' | fold -w 256 | head -n 1 > foo.key
  3. tar -cvjO "foo" | openssl aes-256-cbc -salt -kfile foo.key | dd of="foo.enc"
  4. sha512sum foo.enc >> foo.key (openssl only reads the first line for the key)
  5. sha512sum foo/hashes.sha512 >> foo.key
  6. openssl aes-256-cbc -salt -in foo.key -out foo.key.enc
  7. Manually specify password
  8. Upload foo.enc to S3
  9. Keep foo.key.enc safe!

I have a few key questions:

  • Is this a proper use of each of these tools?
  • Is using /dev/urandom a good method of generating a password?
  • Is my method of storing locally the file encrypted with the weaker key (the one I remember) and only uploading the files that are encrypted with the larger unique keys as strong as it seems?
  • What is the largest value I can put in as the key value for openssl?
  • Any obvious serious issues?
share|improve this question
4  
Why not use a standard tool like duplicity (which supports encryption using gpg and using S3 as storage out of the box)? –  Yoav Aner Jun 24 '12 at 7:06
1  
"Is using /dev/urandom a good method of generating a password?" No, it's a good method to generate a key. –  curiousguy Jun 24 '12 at 13:22
add comment

1 Answer

+1 for Yoav Aner's comment.

I don't have any particular experience with the questions you asked, but it seems like designing such a system from scratch without any prior knowledge and experience will only lead to trouble.

Is there are particular reason you do not want to use premade tools?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.