I am designing my backup system to Amazon S3 (probably Singapore) and I would like to have all my files strongly encrypted on the server. I use ArchLinux x64. My system will append only once an encrypted folder is upload nothing inside this folder will change. eg. I have documents and each month I will upload a folder for that month.
please note I do not want to use Amazon SSE something about them having the keys to my data feels like a waste of time to me (I may use this in addition to what I describe below).
I wish to do the following (to encrypt the folder foo):
- sha512 every file in foo and place the list of hashes in foo/hashes.sha512
dd if=/dev/urandom | tr -dc '[:print:]' | fold -w 256 | head -n 1 > foo.key
tar -cvjO "foo" | openssl aes-256-cbc -salt -kfile foo.key | dd of="foo.enc"
- sha512sum foo.enc >> foo.key (openssl only reads the first line for the key)
- sha512sum foo/hashes.sha512 >> foo.key
- openssl aes-256-cbc -salt -in foo.key -out foo.key.enc
- Manually specify password
- Upload foo.enc to S3
- Keep foo.key.enc safe!
I have a few key questions:
- Is this a proper use of each of these tools?
- Is using
/dev/urandom
a good method of generating a password? - Is my method of storing locally the file encrypted with the weaker key (the one I remember) and only uploading the files that are encrypted with the larger unique keys as strong as it seems?
- What is the largest value I can put in as the key value for openssl?
- Any obvious serious issues?