Symmetric vs asymmetric encryption for backup files uploaded to cloud storage

Question

I want to encrypt my server's backups and upload them to cloud storage (e.g. dropbox, google drive).

I understand the basics with symmetric (single passphrase-secured key) and asymmetric (public/private keypair) encryption. But I don't know which would be more appropriate in my specific use case.

I've read many related questions and there seems to be a 50/50 split between people who recommend the one way or the other (for this specific use case) - but I can't find a reason why.

I know that asymmetric is used when one can perform key exchange between parties, and that it is much slower. So symmetric is typically used to encrypt large payloads.

In my case, my daily backups are a few hundred megabytes each, and there is no key exchange because I am both "sender" and "receiver". And these are secondary backups - I will only decrypt them if my primary backups fail.

So I was planning to store on the server a very long (e.g. 100 char) passphrase, and use it for automated backups using gpg symmetric encryption, which is simple to manage. Is this good enough, or should I rather use asymmetric encryption?

Answer 1

Generate a reasonable long (around 200 bytes) symmetric key, use it to encrypt your backups, and encrypt the symmetric key with a long, secure and protected asymmetric key.

Symmetric key is faster to encrypt, that's why SSL use symmetric keys for encrypting the traffic. It uses asymmetric keys to exchange the symmetric session key. You should to the same.

Using the same key for every backup creates a situation that leaking the key once means every backup can be compromised. Having a different asymmetrical key for each backup means keeping track of every key, for as long as the backup is kept.

And you use the public asymmetric key to encrypt the symmetric one, so the private key is kept protected.

My answer to another question have some more insights.