[SOLVED] re-encrypt backups

[hvisage]

Good day,

I have a case where the encryption keys had been compromised (failed partnership), and there are a specific set of backups I'd like to re-encrypt with a new encryption key. ie. decrypt the current backup sets, en re-write then with a new backup encryption key.

Q1: That is not an in-place option/possibility with the current PBS, correct?

Q2: Possibility/option to read, decrypt and then re-encrypt and write to a new datastore/server?
-> This would be my semi preferred method as I'm also moving to newer PBS setup too.

 

[Chris]

Good day,

I have a case where the encryption keys had been compromised (failed partnership), and there are a specific set of backups I'd like to re-encrypt with a new encryption key. ie. decrypt the current backup sets, en re-write then with a new backup encryption key.

Q1: That is not an in-place option/possibility with the current PBS, correct?

Q2: Possibility/option to read, decrypt and then re-encrypt and write to a new datastore/server?
-> This would be my semi preferred method as I'm also moving to newer PBS setup too.

Hi,
as encryption is performed client side, you will have to restore the individual backup snapshots first using the old/compromised key and perform a new backup using the new/trusted encryption key. There is currently no build-in way to do this.