asymmetric encryption

[atrox]

Hi.

On the page *Recent amanda-user discussion on encryption* it is pointed out that expensive computation of asymmetric encryption isn't issue as many systems use a symmetric encryption key that is encrypted with a public key.

Well, this is about network traffic, right? As I understand, if one wishes to keep his data encrypted with a public key on backup-media (which I see as a true peace of mind, cause symmetric keys may be hijcked by trojas etc), he still has to use the computationally expensive asymmetric algorithm or maintain an encrypted symmetric key for every backup-session.

Have I misunderstood anything?

PS. Has anyone implemented the asymmetric data-encryption already? In the encryption-page it was said that it has to be tested yet.

Silver

[ktill]

> As I understand, if one wishes to keep his data encrypted with a public key on >backup-media (which I see as a true peace of mind, cause symmetric keys may be hijcked >by trojas etc), he still has to use the computationally expensive asymmetric algorithm or >maintain an encrypted symmetric key for every backup-session.
>Have I misunderstood anything?

modern asymmetric encryption uses "hybrid" method. It uses asymmetric method to encrypt the session key(s) while using the less expensive symmetric method to encrypt the actual data.

>PS. Has anyone implemented the asymmetric data-encryption already?
>In the encryption-page it was said that it has to be tested yet.

Amanda Enterprise Edition offered by Zmanda has asymmetric data encryption method using gpg.

--Kevin Till
Zmanda

[atrox]

modern asymmetric encryption uses "hybrid" method. It uses asymmetric method to encrypt the session key(s) while using the less expensive symmetric method to encrypt the actual data.

Yes, I understand that the data is encrypted with symmetric keys. The question is that do the backups remain symmetrically-encrypted on the media also? If they do, the symmetric key has to be stored along with encrypted data, because the symmetric key is recreated by some random() every session, isn't it?

So I suspect the talk here is about transporting backups, not storing them on backup-media.
According to my understanding there is no better way to keep encrypted backups, but to encrypt them asymmetrically.

Have I misunderstood something?

Silver

[ktill]

>If they do, the symmetric key has to be stored along with encrypted data, because the >symmetric key is recreated by some random() every session, isn't it?

session key is encrypted by the public key and it can only be decrypted by the private key. To decrypt the asymmetric encrypted data, you need the private key.
See http://www.rossde.com/PGP/pgp_encrypt.html#combine

[atrox]

Oh, I see.. so the symmetric key is really stored with encrypted data. I just didn't recall the principles of PGP :o

Thanks for the useful link :)