Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a server on witch I keep an encrypted backup of some data. The server updates the backup once a day if the data has been changed. Where would be the best place to store the encryption key considering that a lot of people can get physical access to the server, and still be able to use it if I want to decrypt my data?

share|improve this question
    
What software are you using ? What encryption scheme ? Symmetrical or asymmetrical ? –  Stephane Jul 25 '13 at 11:52
    
The data that needs to be stored is a database from a web application. The application is hosted on Windows Azure servers and I don't have the possibility to encrypt it there. the backup server is on an office therefore I can't have much control on the physical access. The solution I came up so far was to sent the key from a symmetric encryption through email to a group of 'trusted' people. But I like the idea of an asymmetric encryption... Thanks! –  razvan Aug 5 '13 at 13:03
add comment

closed as unclear what you're asking by Adnan, Xander, Gilles, TildalWave, Lucas Kauffman Jul 25 '13 at 18:57

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

up vote 1 down vote accepted

There is the encryption key and also the decryption key. If you are using asymmetric encryption then the two keys can be distinct (though mathematically linked to each other), to the point that the encryption key can be made public.

In your situation, I assume that your server somehow obtains the clear data from an external source, and stores only an encrypted version of the data. If your server is hijacked (and malicious people with physical access can certainly hijack your server) then just have to wait for the next batch of data and slurp it before it gets encrypted.

Solution is to change your model:

  • Have the source encrypt the data, not your storage server.
  • Use asymmetric encryption, so that the source needs only know the public key, not the private key.
  • Don't decrypt on the storage server either; decrypt on your laptop, onto which you download the encrypted backup files when needed. The private key is in your laptop.
  • Now that the storage server is not trusted for anything (it never sees the decryption key, nor the clear text data), replace the server with some cloud-based service, it is cheaper.

Storing secrets, any kind of secret, on a machine which potential attackers can physically access, is an absolute no-go. This will never be safe. There can be some mitigation, but that's very expensive, and not as complete as you would wish (it is more about post-mortem audit than proactive defence).

share|improve this answer
    
The data that needs to be stored is a database from a web application. The application is hosted on Windows Azure servers and I don't have the possibility to encrypt it there. the backup server is on an office therefore I can't have much control on the physical access. The solution I came up so far was to sent the key from a symmetric encryption through email to a group of 'trusted' people. But I like the idea of an asymmetric encryption... Thanks! –  razvan Aug 5 '13 at 11:37
add comment

If someone has physical access to your server, it's not your server anymore. If you are too afraid to store the encryption key on your disk (which can be retrieved from your disk if stored on there). Another option is to run those backups manually and every time insert the password yourself manually. But if someone manages to dump your memory or just installs a key-logger on your machine (considering they have physical access) your key will not be secure, even when introduced manually.

In short: make sure no-one can access your server physically.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.