4 ms·

Borg's encryption is questionable at best. Performance wise it's not particularly good and probably will never get better because of the large, somewhat complex

Borg's encryption is questionable at best. Performance wise it's not particularly good and probably will never get better because of the large, somewhat complex Python codebase.

lima 7y ago
What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way. I'm more concerned about the repository format and config file (i.e. attack surface, since the repo is potentially untrusted). Performance is actually better than Restic, and performance-critical parts of Borg are written in C or use C libraries.
- blattimwind 7y ago
  > What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way. No, using one key per repository and a persistent message counter is not a reasonable design. https://borgbackup.readthedocs.io/en/stable/internals/security.html https://borgbackup.readthedocs.io/en/stable/internals/securi...
  - Erlich_Bachman 7y ago
    For what threat model does this matter?
    - blattimwind 7y ago
      "When the above attack model is extended to include multiple clients independently updating the same repository, then Borg fails to provide confidentiality (i.e. guarantees 3) and 4) do not apply any more)." Edit: I've posted this a bunch of times here, pretty much every time it caught my eye when someone said this tool has good crypto, and by now I'm used to people just downvoting it and saying it doesn't matter because obviously no one ever would use it like that and the design is fine etc. (isn't the point of deduplication to save disk space?)
IshKebab 7y ago
From OPs link: > If we perform similar backups to the same remote destination over SSH (Borg) and SFTP (Restic), the initial backups take roughly the same time, but the subsequent incremental backups take something like 10x longer with Restic. Also I'm wary of encrypting personal backups. I think the chances of me forgetting a password that I used literally once are quite high, and what's the point of a backup if you can't actually access it?
- sjy 7y ago
  I'm worried about that too, but you can deal with it by making the system that automates your backups also test your memory of the password (while still creating a non-interactive backup even if you ignore the prompt). Alternatively, reuse a password that you regularly use offline, like a disk encryption or SSH passphrase.
  - firepoet 7y ago
    Or use a password manager..
trulyrandom 7y ago
I would also like to know more about why you think Borg's encryption is questionable. I'm not familiar with Borg's internals, but there's not much one could do wrong here, as it should just be simple symmetric encryption. Does it not use a strong cipher? Is the cipher used incorrectly? Is the key derivation method weak?

Borg's encryption is questionable at best. Performance wise it's not particularly good and probably will never get better because of the large, somewhat complex Python codebase.

lima 7y ago

What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way. I'm more concerned about the repository format and config file (i.e. attack surface, since the repo is potentially untrusted). Performance is actually better than Restic, and performance-critical parts of Borg are written in C or use C libraries.

blattimwind 7y ago
> What's questionable about it? It seems that they use modern AEAD ciphers in a reasonable way. No, using one key per repository and a persistent message counter is not a reasonable design. https://borgbackup.readthedocs.io/en/stable/internals/security.html https://borgbackup.readthedocs.io/en/stable/internals/securi...
- Erlich_Bachman 7y ago
  For what threat model does this matter?
  - blattimwind 7y ago
    "When the above attack model is extended to include multiple clients independently updating the same repository, then Borg fails to provide confidentiality (i.e. guarantees 3) and 4) do not apply any more)." Edit: I've posted this a bunch of times here, pretty much every time it caught my eye when someone said this tool has good crypto, and by now I'm used to people just downvoting it and saying it doesn't matter because obviously no one ever would use it like that and the design is fine etc. (isn't the point of deduplication to save disk space?)

IshKebab 7y ago

From OPs link: > If we perform similar backups to the same remote destination over SSH (Borg) and SFTP (Restic), the initial backups take roughly the same time, but the subsequent incremental backups take something like 10x longer with Restic. Also I'm wary of encrypting personal backups. I think the chances of me forgetting a password that I used literally once are quite high, and what's the point of a backup if you can't actually access it?

sjy 7y ago
I'm worried about that too, but you can deal with it by making the system that automates your backups also test your memory of the password (while still creating a non-interactive backup even if you ignore the prompt). Alternatively, reuse a password that you regularly use offline, like a disk encryption or SSH passphrase.
- firepoet 7y ago
  Or use a password manager..

trulyrandom 7y ago

I would also like to know more about why you think Borg's encryption is questionable. I'm not familiar with Borg's internals, but there's not much one could do wrong here, as it should just be simple symmetric encryption. Does it not use a strong cipher? Is the cipher used incorrectly? Is the key derivation method weak?