Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm looking for a way to perform encrypted nightly backups of a server I administer, without storing the decryption key on the server.

A form of PK encryption seems ideal for this, as I can store the public key on the server, and the private key somewhere else private (like on a post-it attached to my monitor, or for real security, under my matress). If I need to restore from backups, I can get the private key out of hiding. At least, so goes the theory...

However, only a small amount of data can be encrypted with an RSA public key, so this needs to be a symmetric key used for the actual encryption, which must be generated at the time of file encryption and stored alongside the backup so I don't have to store this on the server.

Given the above, do the following two simple shell scripts make security sense, and what (if any) existing and proven Open-Source software is available to do something like this?

#this is the encryption system used like this: ./crypt.sh publickey.pem mycleartextfile.txt


SESSION_KEY=`openssl rand 256`
echo "$SESSION_KEY" | openssl pkeyutl -encrypt -pubin -inkey "$PUBKEY" -out "$CLEARTEXT_FILE".key
echo "$SESSION_KEY" | openssl enc -in "$CLEARTEXT_FILE" -e -blowfish -out "$CLEARTEXT_FILE".openssl -pass stdin

...and the decryption script:

#usage ./decrypt privatekey.pem encrypted-file-session.key encrypted-file

openssl pkeyutl -decrypt -inkey "$PRIVATE_KEY" -in "$SESSION_KEY_CRYPT" \
| openssl enc -d -blowfish -in "$CIPHERTEXT_FILE" -out "$CIPHERTEXT_FILE".out -pass stdin

Any thoughts on this are much appreciated.

share|improve this question
You've got the right idea. Note: openssl rand 256 genertes 256 bytes of output. 256 bits would be enough for a symmetric key. –  Brock Hansen Feb 28 '14 at 23:32
openssl rand 256's output is binary. How sure are you that your SESSION_KEY variable can hold 256 bytes that may include binary zero bytes? A test script I just tried couldn't, under a Linux bash shell. –  Brock Hansen Feb 28 '14 at 23:34
@BrockHansen I hadn't considered that, but I tried a bunch of times in GNU bash, version 4.2.45(1)-release on Debian Sid and it seems to work fine. I will however look into this concern. Thanks for pointing it out. –  ldrumm Feb 28 '14 at 23:36
Why blowfish? Doesn't it have a 64-bit block size? Why not AES? –  Brock Hansen Feb 28 '14 at 23:41
Are unauthorized or otherwise unexpected changes to the backup file part of your threat model? I've never used the openssl command myself. Does the ciphertext output include any message authentication code when you don't explicitly specify a mode? –  Brock Hansen Feb 28 '14 at 23:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.