5

I have all my backup hard drives encrypted with LUKS. Currently, the passphrase is some 25+ random password that I store in my password manager KeePassX. Since I have the backup drives for the case that a single one of the is the only working drive left, I have a small unencrypted partition on them where I have this password manager file. That way, I only have to remember my long password for the passwort manager and use a strong password for the disk encryption and a different password for every disk.'

A friend pointed out that in effect this is not better than just having the same password on all the disks that I can memorize.

Are there reasons to pick one approach over the other one? I have no idea whether the password on LUKS or KeePassX would be harder to crack. What I thought about is that each LUKS drive probably has the a different crypto key, which might not be good if those different keys are protected with the same password?

All those backups disks contain the exact same data, so it only matters whether one of the drives is brached.

Improve this question

2 Answers 2

Reset to default
3

There is a major advantage to asymmetric encryption for backups: you can make the backup automatically, because this only requires the public key. Only restoring requires the private key, and that can usually be interactive, because it's a rare operation.

Symmetric encryption has a definite performance advantage, especially if you do it at the media level. But as your friend notices, backing up the encryption key with the ciphertext defeats the purpose of encryption. In your scenario, your backup is as easy to crack as your memorable password.

You can get the best of both worlds by using asymmetric encryption (e.g. with a GPG key) to save your key store. Since this is a small file, it won't hurt performance. Use a strong, long, randomly-generated passphrase for the GPG key, which you won't need often. Write down the passphrase on a piece of paper and put the piece of paper in a safe. (Actually you'll probably want several copies in different places!)

Improve this answer
2
  • As an extension/simplification of this: why not just print the private key on a paper (QR core or something similar), and store it somewhere safe?
    – domen
    Commented Dec 22, 2014 at 10:16
  • QR is a good suggestion. Print the code out as well, make a remark that you know what this code is for, and that nobody should throw it away without asking you. Be careful with the font you use, to make sure that 0-O (zero-oh) and 1-l (one-el) and other letters are printed out in a way you cannot confuse them. You could print out 0123456789 below the code so you can compare it. Print it with a laser printer, not ink jet.
    – SPRBRN
    Commented Dec 22, 2014 at 10:25
2

If you want to be safe from legal vulnerability then you should NEVER keep a critically important password anywhere but inside your own mind. That gives you Fifth Amendment protection against having to disclose it. Writing down a password and putting it in a safe, etc., leaves you legally vulnerable to a search warrant.

https://www.eff.org/press/releases/appeals-court-upholds-constitutional-right-against-forced-decryption

Improve this answer
2
  • 1
    Fifth Amendment protection (United States) is assured only within the jurisdiction of the Eleventh Federal Circuit Court of Appeals. For example, Ramona Fricosu (eff.org/cases/us-v-fricosu) was jailed for contempt for failure to supply a password. (Until her hisband ratted her out by giving the Feds a list of possible passwords.) And, of course, The Supremes could overrule the Eleventh Circuit. With all of that said, keeping a passphrase on your head and nowhere else is a good idea if you fear a search warrant. Or, just do not possess contraband.
    – Bob Brown
    Commented Dec 28, 2014 at 17:56
  • I also assume that this only applies to US citizens, which I am not one of. And since a good portion of US people seems to be okay with torture, I guess it does not really make a difference where exactly the key is when you are up against a (foreign) government. Regarding contraband: I am just concerned about my privacy regarding a plain thief stealing one of my backup hard drives or my laptop.
    – Martin Ueding
    Commented Dec 30, 2014 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .