Am 05.11.26 um 17:51 schrieb Martin Simmons:
Yes, I think the "you will need them to create File Daemon keys" part is
wrong. The part about using them if you lose the File Daemon keys is correct.
Yes. It somehow sounds like if the FD keys depend on the Master key.
That's what confused me.
Bacula's data encryption doesn't use these keys directly to encrypt the data.
Interesting ...
Instead, it works by generating a random encryption key (called the session
key) to encrypt the data and writes the session key to the volume, encrypted
with the public key in the PKI Keypair file. This allows the session key to
be decrypted using the private key in that file and then the data can be
decrypted using the session key.
If you also provide the PKI Master Key directive, then it writes a second copy
of the session key encrypted with the master public key in that file. This
allows the session key to also be decrypted using the master private key after
following the instructions in
https://docs.baculasystems.com/BEAdvancedFeaturesUsage/DataEncryption/FileDaemonEncryption/DecryptingWithMasterKey/index.html
Ah, OK, so it's basically a backup set of keys, right?
I am no crypto expert: why is the FD key*pair* used, but only the master
public *key* ? Just curious, while we're at it ;-)
Thanks a lot, I will proceed setting this up now.
_______________________________________________
Bacula-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-users
