I'm evaluating some backup tools to find a good solution for my scenario and I was wondering about a common security choice in a lot of these tools.

I've noticed that backup software commonly encrypt backups and restore files from encrypted backups with the same key. So using symmetric encryption.

Why is not preferred instead to use an asymmetric encryption: a key to encrypt data and a different one to use in restore operations to decrypt previously encrypted data?


All crypto prodcuts use symmetric keys to encrypt data. RSA operations are so slow in practice that no sane person ever use them to ecnrypt/decrypt data. All RSA based encryption schemes use a symmetric key to encrypt the data and encrypt the symmetric key with the RSA key. The addition of an RSA operation allows to digitally sign the data and/or to safely exchange the symmetric key with a remote site.

For the typical backup restore scenario there is absolutely 0 (zero) benefit from using RSA operations (more correctly: I don't see any benefit). More precisely, there is no need sign the backup with a private key for authentication purposes, and there is no need to encrypt the encryption key with a public key for key transport/exchange purposes. Using RSA keys would simply add complexity and operational risks but would offer no additional benefits.

The only RSA key usage for a backup/restore scenario I can think of right now is if a hardware module is involved (ie. the backup operator must enter the smart-badge into the reader to open the backup file).

  • I think that the problem is that if you have access to the machine being backed up you can access the encrypted backups using the encryption symmetric key used by the backup software that could be found in the settings/RAM of the computer. This is obviously an extreme situation and the answer "taking care of this borderline case would be too difficult even in terms of computation time" seems good enough for me. – Andrea Zilio Mar 2 '10 at 2:02
  • Keep in mind that RSA operations you can do about 100/second, and you encrypt a block of key length size (say 4096 bits). Ignoring there is no RSA block chaining mode, nor an API to encrypt large data sizes with RSA, just compute how long would it be to encrypt a 1Gb file. – Remus Rusanu Mar 2 '10 at 3:39

Probably because it's easier to manage a symmetrically encrypted chunk of data rather than use a public key scheme where you'd have to manage a private key along with a decryption key, when what you really need is to get your restore done to get the data back online for the users, but that's just a guess.

It would be one more thing to go wrong, needing to keep a hidden private key somewhere or archive the key along with the necessary private key.

Why make it more complicated than is needed?

  1. Speed - Symmetric key encryption is much faster.
  2. Complexity - Backups need to just work. Adding complexity is dangerous.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.