Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I use Acronis backup software to create images of my system, have a copy of important stuff in the cloud and all other backup related things.
As Acronis states, their software uses AES encryption which happens locally.
But I have found that Acronis have some catch in EULA:
So does it mean that their encryption worth nothing?
The 'worth' of the encryption in this case (which has nothing to do with the actual encryption as I'll explain below) is completely opinion-based, so you better rephrase that. But I'll try to explain the meaning of the EULA:
This means that they have the symmetric AES key to do the decryption. Their encryption isn't worth nothing per se, it is worth as much as you are willing to trust Acronis. Meaning, the AES encryption is in place, but they have the ability to decrypt your data. The question is do they? or will they? These are questions no one on this site will be able to answer. And the decision of trusting them is yours to make.
Acronis True Image lets you encrypt client-side, too. The password you set creates a private key that only you know. So, if you set that up, Acronis won't be able to decrypt your data even under a court order. To set a private key, from the desktop tool "backup" pane, go to "option" > "advanced." Set your password under the "backup protection" heading.
If you don't set private encryption, the company still encrypts your data at rest, but they have the encryption key.
If the question is regarding the Acronis True Image cloud : it is not "zero-knowledge".
If you already have an encrypted backup in the Acronis Cloud, here is an easy way to check that :
Thus, your encryption key is fully sent to the Acronis server, and they can use it to decrypt your data.
Now, it's up to you to trust them that they did not memorize your encryption key. For example, by order of a judge, they could be asked to sniff your encryption key. Or an employee who has access to the server could capture / log the traffic and see your private key.
Acronis True Image appears to indicate that the company does not have access to the user's encryption key. Their documentation page here says: "Warning! A password of an online backup cannot be retrieved. Please memorize the password that you specify for backup protection."
In the subroutine responsible for generating encryption key in Acronis True Image 2017 i found interesting OpenSSL library calls (EVP_PKEY_, d2i_X509). These are used for encrypting "something" which appears to be randomly generated encryption key with public key embedded inside Acronis.
The use of public key encryption inside function responsible for generating secure random encryption key is rather suspicious. There's possibility that after the "random" key is generated - it's then encrypted using acronis public key and stored inside TIB file. Which means the owner of corresponding private key (Acronis), might in theory decrypt that data, and gain access to the real "random" encryption key.
The functionality is currently disabled at least in 2017 version of acronis, however presence of such code might mean that it can be reenabled in custom builds in some regions and countries.
By default, the public key encryption is skipped for now and following code at the bottom is executed:
Full decompilation results are available here: https://pastebin.com/3x0WnGiF
So based on that, you can decide whether acronis encryption is secure or not.
