I am designing my backup system to Amazon S3 (probably Singapore) and I would like to have all my files strongly encrypted on the server. I use ArchLinux x64. My system will append only once an encrypted folder is upload nothing inside this folder will change. eg. I have documents and each month I will upload a folder for that month.

please note I do not want to use Amazon SSE something about them having the keys to my data feels like a waste of time to me (I may use this in addition to what I describe below).

I wish to do the following (to encrypt the folder foo):

  1. sha512 every file in foo and place the list of hashes in foo/hashes.sha512
  2. dd if=/dev/urandom | tr -dc '[:print:]' | fold -w 256 | head -n 1 > foo.key
  3. tar -cvjO "foo" | openssl aes-256-cbc -salt -kfile foo.key | dd of="foo.enc"
  4. sha512sum foo.enc >> foo.key (openssl only reads the first line for the key)
  5. sha512sum foo/hashes.sha512 >> foo.key
  6. openssl aes-256-cbc -salt -in foo.key -out foo.key.enc
  7. Manually specify password
  8. Upload foo.enc to S3
  9. Keep foo.key.enc safe!

I have a few key questions:

  • Is this a proper use of each of these tools?
  • Is using /dev/urandom a good method of generating a password?
  • Is my method of storing locally the file encrypted with the weaker key (the one I remember) and only uploading the files that are encrypted with the larger unique keys as strong as it seems?
  • What is the largest value I can put in as the key value for openssl?
  • Any obvious serious issues?
  • 4
    Why not use a standard tool like duplicity (which supports encryption using gpg and using S3 as storage out of the box)?
    – Yoav Aner
    Jun 24, 2012 at 7:06
  • 1
    "Is using /dev/urandom a good method of generating a password?" No, it's a good method to generate a key.
    – curiousguy
    Jun 24, 2012 at 13:22

1 Answer 1


+1 for Yoav Aner's comment.

I don't have any particular experience with the questions you asked, but it seems like designing such a system from scratch without any prior knowledge and experience will only lead to trouble.

Is there are particular reason you do not want to use premade tools?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .