To: Lars Wirzenius <liw@liw.fi>
References: <2d0a8c01-9f58-1ee7-7e20-53fe65d96718@palant.de>
 <20170703050540.p5co243yxedvsaca@liw.fi>
From: Wladimir Palant <gtiobnam@palant.de>
Message-ID: <23949c28-f4b0-04bb-d4b8-c6569c94820b@palant.de>
Date: Mon, 3 Jul 2017 09:48:45 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.1.1
MIME-Version: 1.0
In-Reply-To: <20170703050540.p5co243yxedvsaca@liw.fi>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Cc: obnam-dev@obnam.org
Subject: Re: [rfc] Passphrase-based encryption
Precedence: list
Sender: obnam-dev-bounces@obnam.org
Errors-To: obnam-dev-bounces@obnam.org

On 03.07.2017 07:05, Lars Wirzenius wrote:
> If you want this, you should write a plugin that adds symmetric
> encryption in addition to the PGP based on that Obnam currently
> provides. You should probably do it by only encrypting the symmetric
> encryption key that PGP encrypts. This would allow PGP and symmetric
> to be used on the same repo by different clients.

Not really worth it as long as I'm the only one using that plugin, I'd 
rather stay with my simple approach then.

> I am afraid, however, that I am unlikely to accept the plugin into
> Obnam proper, since I don't think it makes things better. It's true
> that it will probably be easier to set up, but at the cost of more
> difficult key management.

No problem, if it isn't a good match for the overall concept then so be it.

> Backing up small files such as PGP keys is so easy I don't agree with
> that part of your argument. It's a matter of a few kilobytes. You
> could put the key into a QR code and print it on paper.

My thought was rather encrypting it with a passphrase and storing next 
to the actual backup. Doing this correctly turned out non-trivial, with 
both GPG's own passphrase encryption and OpenSSL's enc tool using 
suboptimal key derivation to say the least.

> Also, environment variables can be read by other processes, just like
> command line arguments can be. See /proc/*/environ. The environ files
> are only readable by the owner, but it's still not a way to pass
> secrets, in my opinion. Defense in depth, and all that.

There aren't too many ways to pass secrets and AFAIK none of them will 
protect against other processes running with the same privileges. For 
example, you could require the passphrase to be stored in a file 
readable only by the owner - but this protection will be equivalent to 
the way /proc/*/environ is protected (or GPG keys for that matter).

regards
Wladimir

_______________________________________________
obnam-dev mailing list
obnam-dev@obnam.org
http://listmaster.pepperfish.net/cgi-bin/mailman/listinfo/obnam-dev-obnam.org