I'm tarballing and compressing backup files of my system configuration, and other important stuff. The process of tarballing, compressing and encrypting happens every time rsnapshot changes something in my backup folder, which means inserting the password of my personal GnuPG when I want to encrypt the tarball file to, well, myself.

I want to know if doing encryption of files in this way is safe and don't represent a security risk for my files.

This is how I'm currently encrypting files to myself:


UBICACION=/home/jorge/respaldo/configuracion\ del\ sistema
chown jorge "$UBICACION/respaldos.tar.7z"
# lo ciframos
DISPLAY=:0 sudo -u jorge -- gpg --no-tty -z 0 --no-greeting --encrypt --sign --yes --local-user elcorreo@deshackra.com -r elcorreo@deshackra.com "$UBICACION/respaldos.tar.7z"

Encryption does not require the private key

First of all, encryption does not require the password of the private key, encryption is peformed using the (unprotected) public key. The operation requiring the private key's passphrase is signing the data, do you really require this for your backup strategy?

Potential risks of unencrypted private keys

There is one obvious risk: if an attacker gets access to your unencrypted private key (ie. one without a password), he has immediate control over the key. If the key would have been encrypted (by a password), there would still have been the barrier of the password.

With other words: yes, this is a security risk; how large it is depends on your very specific use case, security practice and environment and can hardly be weighted by anybody but yourself.

To get a feeling whether this risk is something you want to take, consider (likely among others, this surely is no complete list):

  • chances of the machine/hard drive being stolen (in case it's not reasonably encrypted anyway)
  • somebody might get (physically) hold of the unlocked computer
  • you share the private key by accident or software issues
  • unpatched exploits in applications you use, allowing an attacker to backdoor your computer

Use gpg-agent

As an alternative, consider using the GnuPG agent gpg-agent, which is necessary with newer versions of GnuPG anyway, and allows you to cache your passphrase for a while (the exact duration can be configured), which reduces risks heavily without including too many hassles in daily use.

  • I just deleted the --sign flag! Thank you for the answer! – shackra Dec 14 '15 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.