3 ms·
I'm currently writing my own backup tool because of one feature I want that nothing else seems to have. In my opinion, it's not enough to distrust the server wh
by xmodem 6y ago
I'm currently writing my own backup tool because of one feature I want that nothing else seems to have. In my opinion, it's not enough to distrust the server where the backups are stored. The client should also not need to keep around a key that can be used to decrypt the backups for the purpose of encrypting new backups.
This is quite easy to accomplish with public key cryptography - just use a new, random AES key for each backup job, then encrypt that with a public key you keep around. The private key can be stored offline in cold storage.
- cyphar 6y agordedup (mentioned in a few other comments) uses asymmetric cryptography[1]. [1]: https://github.com/dpc/rdedup/ https://github.com/dpc/rdedup/
- xmodem 6y agoThanks - this seems useful, but currently > cloud backends are WIP and I probably don't have good enough rust skills to help out myself practically.
- cyphar 6y agoCloud backends aren't really needed imho if you use something like rclone. Native cloud backends can make transfer order more intelligent but rclone does deletes last meaning you won't lose data if the transfer dies mid-transfer.
- seized 6y agoDuplicacy can do that with it's RSA option. My private key isn't on the VM doing the backing up.
- aborsy 6y agoBut asymmetric crypto does that under hood (hybrid encryption). In fact, if you encrypt the same file twice with rsa you get different cipher text. No one encrypts a file directly with RSA. It’s the data encryption key that is encrypted .