Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term storage. But how can I ensure that the encryption is future-proof, and that I will be able to access the data an arbitrary amount of time in the future?

share|improve this question
8  
The same issue occurs with hardware. How will you read these floppies ? Or Zip disks ? Jaz disks anyone ? Even CDROM readers are becoming rarer... The only path to redemption is regular maintenance: check your backups, transfer to new formats and mediums when necessary. –  Thomas Pornin Feb 8 '13 at 20:01
    
Use open sources softwares! (And store sources too! ;) –  F. Hauri Feb 8 '13 at 20:06
    
You need to store the entire OS, what if the libraries used become deprecated and the software can't compile anymore? –  LtWorf Feb 9 '13 at 20:50

4 Answers 4

When dealing with encrypted data, you must be careful to pay attention to the systems and software that will be necessary to decrypt it. If at any point it becomes foreseeable that the systems or software necessary to decrypt your data will no longer be available, you then must consider alternative methods of encrypting/decrypting the data.

When an alternative encryption/decryption method is available, and deemed necessary, use your current methods to decrypt the data and then immediately re-encrypt it with the new method.

Of course, it should go without saying that you should always keep good backups of your data - in fact, the backups might be the best option for testing your new encryption/decryption method before performing it on your live data.

share|improve this answer

In addition to what Iszi said, sticking with encryption products that have known algorithms can be helpful in future proofing since you can always implement a custom solution in the future if necessary as long as the algorithm needed to decode the information is also known.

The best bet is still to make sure to decrypt and re-encrypt before a particular system reaches end of life though, unless you need to encrypt for archival storage, in which case, stick to standard algorithms that can be reproduced later.

share|improve this answer

There are some policies you can implement to help avoid being locked out of your data due to software obsolescence.

  • Avoid obscure or proprietary software. Open source is preferable.
  • Keep the source code and installation binaries of your encryption/decryption utilities, in an unencrypted backup.
  • Also ensure any in-house utilities or scripts necessary for accessing your data are backed up in the clear.
  • Make sure all encryption/decryption keys (and their backups) are stored in a secure location.

If the security of your backup is compromised, you could re-encrypt all of your backup data or just put the old backup data in a new encrypted container. The latter method may save a lot of time upgrading, but will add greater overhead when you need to access your backups later.

share|improve this answer

I'm going to suggest that this is a set of data where encryption is probably not the best option.

Get a securely lockable box, secure the keys and put it in a safety deposit box at your bank.

For family records, you probably want people to be able to get at them when you're not around, and you probably want to keep them a long time. Over an "arbitrary amount of time" you're also likely to forget about backing up keys, or about how you set up the encryption, or the software you need to carry across if you ever get a new PC.

share|improve this answer
    
I disagree here on two grounds. First, protection of this data is very important as it will likely contain PII and other sensitive information for several generations of one's family - at least two of which are likely to be currently living. Second, securely storing a "failsafe" copy of your encryption software and keys in a place other family members can get to is just as easy as storing the records themselves in a safety deposit as you suggest. –  Iszi Feb 9 '13 at 3:13
1  
Not sure I follow why this is getting downvoted - the most secure and maintainable software is often no software at all, and one of the big issues in our industry is applying technical and software solutions to areas where technical and software solutions just aren't a good fit. –  Bob Watson Feb 9 '13 at 3:15
    
@Iszi You're making a bold prediction that generation 2 or 3 is going to be running an OS that can run the software you're storing as a failsafe (or have the technical chops to boot your VM). –  Bob Watson Feb 9 '13 at 3:17
    
For that contingency, you could store an entire pre-loaded laptop as your failsafe. Or, you could leave instructions for them to use your own computer. In any case, there are few solutions that offer better protection of data while at the same time enabling ease of authorized access as encryption. –  Iszi Feb 9 '13 at 3:22
    
I don't know of any laptops that will have a battery that lasts > 30 years and still have batteries available to buy at that time. And you're assuming that computer will still be maintained and up to date. Adding technology to this problem adds a number of things that can go wrong, whereas keys and padlocks are pretty stable. –  Bob Watson Feb 9 '13 at 3:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.