How to avoid to lose data encrypted because it was encrypted by no longer supported software?

Question

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term storage. But how can I ensure that the encryption is future-proof, and that I will be able to access the data an arbitrary amount of time in the future?

Answer 1

When dealing with encrypted data, you must be careful to pay attention to the systems and software that will be necessary to decrypt it. If at any point it becomes foreseeable that the systems or software necessary to decrypt your data will no longer be available, you then must consider alternative methods of encrypting/decrypting the data.

When an alternative encryption/decryption method is available, and deemed necessary, use your current methods to decrypt the data and then immediately re-encrypt it with the new method.

Of course, it should go without saying that you should always keep good backups of your data - in fact, the backups might be the best option for testing your new encryption/decryption method before performing it on your live data.

Answer 2

In addition to what Iszi said, sticking with encryption products that have known algorithms can be helpful in future proofing since you can always implement a custom solution in the future if necessary as long as the algorithm needed to decode the information is also known.

The best bet is still to make sure to decrypt and re-encrypt before a particular system reaches end of life though, unless you need to encrypt for archival storage, in which case, stick to standard algorithms that can be reproduced later.

Answer 3

There are some policies you can implement to help avoid being locked out of your data due to software obsolescence.

• Avoid obscure or proprietary software. Open source is preferable.
• Keep the source code and installation binaries of your encryption/decryption utilities, in an unencrypted backup.
• Also ensure any in-house utilities or scripts necessary for accessing your data are backed up in the clear.
• Make sure all encryption/decryption keys (and their backups) are stored in a secure location.

If the security of your backup is compromised, you could re-encrypt all of your backup data or just put the old backup data in a new encrypted container. The latter method may save a lot of time upgrading, but will add greater overhead when you need to access your backups later.

Answer 4

I'm going to suggest that this is a set of data where encryption is probably not the best option.

Get a securely lockable box, secure the keys and put it in a safety deposit box at your bank.

For family records, you probably want people to be able to get at them when you're not around, and you probably want to keep them a long time. Over an "arbitrary amount of time" you're also likely to forget about backing up keys, or about how you set up the encryption, or the software you need to carry across if you ever get a new PC.

Answer 5

Do not use an IT solution for a non-IT problem. Could your great aunty Mary use those 'valuable family records' if you gave them to her tomorrow, if not, then why do you expect them to be useful to her or anyone else in thirty years or more.

Forget crypto and IT solutions, this is a simple document handling situation. Paper document. Print them out and put them in a 'trusted' location such as a solicitors office or a bank box with instructions on how they are to be disposed of in the future.