Every day, I must backup my server's files, encrypt the backup, and upload it to untrusted cloud storage (dropbox, s3, etc.)
I've spent time on security.stackexchange where I discovered the typical approach is:
- encrypt the backup with random one-time symmetric key ("session" key), for speed
- encrypt the session key with an asymmetric key ("master" key: the public key in a public/private keypair)
- upload the encrypted backup and encrypted session key to cloud storage
But I don't understand: why not use another symmetric key as the master key? Put another way: there is no key exchange here, as I am both "sender" and "receiver" - so how do I benefit from using an asymmetric key as master?
(For example, I'm using
gpg, so my server could store a symmetric key with a 100-char passphrase, and use it to encrypt the daily session keys.)