Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on an automated backup solution to protect my files on my Linux servers. However, I'm not sure about how to securely encrypt the resulting archieves. I am using 64bit linux, and I am looking for a solution that would have a seperate key/password for each individual archive backed up.

I've seen solutions such as:

  1. Using truecrypt to create a small container for the individual archieve
  2. Creating a luks?/dmcrypt volume and just putting everything in there

How would I do this where each backup copy would have its individual key/key files? I'm looking for a solution that where all of the private keys would not be exposed on the machine being backed up? [I.e. I have a key file, and it has a generated keyfile just for that backup]

share|improve this question
add comment

2 Answers

First of all, I wouldn't recommend using disk encryption tools for this particular purpose as they are optimized for (surprise) hard disk encryption:

https://en.wikipedia.org/wiki/Disk_encryption_theory

It is possible that some implementations can adjust themselves for "simple" file encryption, I suggest to consult the appropriate documentation about this matter.

If you don't want to expose your decryption key in any way to the machine to be backed up (that sounds like a good design decision) an obvious solution is using hybrid crypto-systems. An obvious choice would be OpenSSL that is easily scriptable as described here:

http://blog.altudov.com/2010/09/27/using-openssl-for-asymmetric-encryption-of-backups/

share|improve this answer
    
Hard drive encryption would be a bad situation for this since it just puts everything in the same treasure chest. I just need the setup to work so that if one backup is compromised then the other backups are still safe. –  monksy Jul 1 '13 at 18:20
add comment

You should consider GPG or PGP as an option. GPG should work find on the command line or embedded in a script and all you need on your computer is the public half of the key-pair. The private half (the decryption key) can be kept offline on a USB thumb-drive or on another system.

When you use GPG to encrypt a file it will create a new symmetric key, use that to encrypt the data and then use the public key to encrypt the symmetric key. If you run the same gpg command to encrypt your backup file every day, each file will have it's own unique encryption key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.