Re: symmetric key encryption utilities

[Wouter Slegers <wouter@yourcreativesolutions.nl>]

On Wed, Jul 04, 2001 at 11:13:56PM -0600, Curtis Collicutt wrote:
> I just want to encrypt a file with a specific key without
> a passphrase, the way symmetric encryption was meant to 
> be done (and without storing the key in the file). 
The one thing that puzzles me, is your insistance on a symmetric key.
Why not use PGP/GPG or similar like this:
Encrypt the tar of a system X with Pub_X and send it off to the backup
server. Keep the Sec_X (i.e. the secret keyring) on the system if you
like, but at least make sure you don't loose it (burning it on a CD or
writing it on a floppy and storing it in a [offsite?] vault is
preferred).
Now the backup server cannot decrypt any backup as it does not hold the
correponding secret keys, satisfying your goal.
If you do not put Sec_X on the server itself but on the restore disk/CD
(and a backup somewhere else!), an attacker rooting one of your servers
cannot access older backups. Putting Sec_X on the server itself is only
for convenience at restore time and then this key itself may have been
destroyed :-)

BTW, amanda has some supporting scripts that allow you to do similar
things I believe.

With kind regards
Wouter Slegers