OpenPGP encrypting backup files and sending them to Usenet servers

Question

My Internet service provider includes Usenet servers with about about 45 days of retention. I'm planning to backup my most important files on there.

I have a 50Mb/s symmetrical fiber connection to the internet, however all the Internet service provider's own services have a different limit of 500Mb/s symmetrical. This includes the Usenet servers (upload test showed an average speed of 39MB/s, limited by hard drive speed).

I want to backup my pictures and some important documents, however simply uploading them there would make them available for the world to see. So first I tar them.

tar -cf $_file -P /user/pictures /user/importantFiles /user/log/

Then I generated a 4096 bit RSA keypair. I imported the public key into GnuPG on my file server.

Now I'm planning on encrypting it with GnuPG and AES 256 bit.

gpg --output $_file.enc --symmetric --cipher-algo AES256 test.out -r [8NumberIDHere]

then I delete the original file.

rm -f $_file

After which I start the upload to my Internet service provider's Usenet server.

I'm planning on doing this once a week while keep I keep using the same public key. The total file size we're talking about after taring is about 15GB.

Yes, I asked my Internet service provider, and they told me they have no problem with me using it as a ~45 days backup location.

Am I doing everything correctly? How secure will the uploaded files be? Am I overlooking something?

Answer 1

In principle, encrypting with AES 256 bit should be fine, as long as you don't mess up (and upload unencrypted information by accident), the math stays secure (new findings could harm the used algorithm's security in future) and finally the data really does not deleted exactly at the time you require to restore from your backup.

Using --symmetric encryption will disable public/private key cryptography, as already indicated in GnuPG's warning message:

$ gpg --recipient a4ff2279 --symmetric
gpg: WARNING: recipients (-r) given without using public key encryption

If you want to do public/private key cryptography, do not use the --symmetric option, otherwise don't use the -r/--recipient flag to denote a public key to encrypt for. OpenPGP is a hybrid cryptography protocol, and will use symmetric encryption anyway -- but will use a random session key encrypted using your public key instead of a (weaker) passphrase.

Anyway: although your provider accepted you (mis)using their servers for this purpose, I'd not go for that route:

• You distribute the data publicly to everybody. If your private key is weak, lost or gets public for any other reason, "the whole world" might be able to read your backup. The same applies if you upload unencrypted information by accident!
• You are allowed to (mis)use the servers, but have no guarantees they don't change their mind and delete the files at any time.

15GB of data are not a lot. There are lots of services providing you with a personal cloud storage in that size, even for free. Not only are you using the storage in the way it is purposed to be used, but also there is some additional safety net in case something goes wrong, and not everybody can read your data (although you also should remember: "there is no cloud, just other people's computers" and you still have to put some trust in them (so encryption on your client computer/file server is a very good thing go do).