I have collected a lot of data (approx 3TB) in photos and videos over the years, I've been upgrading to newer and bigger hard disks and luckily they've not failed on me. I've realized that my access pattern is write once and read very rarely, I think AWS Glacier is a good fit for my use-case.
At first, I thought that I'd go with their BYOK
offering to encrypt my data but after doing a bit of reading it appears that BYOK
has zero security benefits and is only a marketing ploy. Given that the cloud provider would have access to my key, they could theoretically (actually practically too) access my data without my consent.
Therefore I think that it would be more sensible for me to encrypt my data before I upload the data into Glacier. I've been doing some more reading and it seems that I have two choices using -
- Symmetric Key with AES and the like
- Asymmetric Key with RSA or GPG
I don't want to store the keys/password that I use on my machine for longer than I need to and am wondering if I could use a physical Yubikey
to actually decrypt the data when needed.
I'm not quite sure how Yubikey fits in with the two choices and which one is better?
I plan on storing the private key/password on another cloud storage like Dropbox or so to keep them at an arms length, ideally I'd only need to access that if my Yubikey goes bad. I do realize that this may not be perfect but without being able to access the data in case of a catastrophic failure would defeat the purpose of the backup. The data will contain personal photos, videos and some documents if that matters in the choosing the appropriate strategy.
The main questions that I have are -
- What is the more appropriate choice for my situation?
- What is the right keysize for the choice? My understanding is the bigger the better. Since I don't need to access this data frequently I'm happy with the encryption/decryption taking longer.
- Any personal anecdotes or recommendations that you may have for me that will help me secure the data and balance security and usability?