I have a server on witch I keep an encrypted backup of some data. The server updates the backup once a day if the data has been changed. Where would be the best place to store the encryption key considering that a lot of people can get physical access to the server, and still be able to use it if I want to decrypt my data?
closed as unclear what you're asking by Adnan, Xander, Gilles, TildalWave, Lucas Kauffman Jul 25 at 18:57
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking.If this question can be reworded to fit the rules in the help center, please edit the question.
There is the encryption key and also the decryption key. If you are using asymmetric encryption then the two keys can be distinct (though mathematically linked to each other), to the point that the encryption key can be made public.
In your situation, I assume that your server somehow obtains the clear data from an external source, and stores only an encrypted version of the data. If your server is hijacked (and malicious people with physical access can certainly hijack your server) then just have to wait for the next batch of data and slurp it before it gets encrypted.
Solution is to change your model:
Storing secrets, any kind of secret, on a machine which potential attackers can physically access, is an absolute no-go. This will never be safe. There can be some mitigation, but that's very expensive, and not as complete as you would wish (it is more about post-mortem audit than proactive defence).
If someone has physical access to your server, it's not your server anymore. If you are too afraid to store the encryption key on your disk (which can be retrieved from your disk if stored on there). Another option is to run those backups manually and every time insert the password yourself manually. But if someone manages to dump your memory or just installs a key-logger on your machine (considering they have physical access) your key will not be secure, even when introduced manually.
In short: make sure no-one can access your server physically.