After 10+ years of data hoarding (currently sitting on ~80TB across multiple systems), had a wake-up call about backup encryption key protection that might interest this community.
The Problem: Most of us encrypt our backup drives - whether it's borg/restic repositories, encrypted external drives, or cloud backups. But we're creating a single point of failure with the encryption keys/passphrases. Lose that key = lose everything. House fire, hardware wallet failure, forgotten password location = decades of collected data gone forever.
Links:
Context: My Data Hoarding Setup
What I'm protecting:
- 25TB Borg repository (daily backups going back 8 years)
- 15TB of media archives (family photos/videos, rare documentaries, music)
- 20TB miscellaneous data hoard (software archives, technical documentation, research papers)
- 18TB cloud backup encrypted with duplicity
- Multiple encrypted external drives for offsite storage
The encryption key problem: Each repository is protected by a strong passphrase, but those passphrases were stored in a password manager + written on paper in a fire safe. Single points of failure everywhere.
Mathematical Solution: Shamir's Secret Sharing
Our team built a tool that mathematically splits encryption keys so you need K out of N pieces to reconstruct them, but fewer pieces reveal nothing:
bash
# Split your borg repo passphrase into 5 pieces, need any 3 to recover
fractum encrypt borg-repo-passphrase.txt --threshold 3 --shares 5 --label "borg-main"
# Same for other critical passphrases
fractum encrypt duplicity-key.txt --threshold 3 --shares 5 --label "cloud-backup"
Why this matters for data hoarders:
- Disaster resilience: House fire destroys your safe + computer, but shares stored with family/friends/bank let you recover
- No single point of failure: Can't lose access because one storage location fails
- Inheritance planning: Family can pool shares to access your data collection after you're gone
- Geographic distribution: Spread shares across different locations/people
Real-World Data Hoarder Scenarios
Scenario 1: The Borg Repository Your 25TB borg repository spans 8 years of incremental backups. Passphrase gets corrupted on your password manager + house fire destroys the paper backup = everything gone.
With secret sharing: Passphrase split across 5 locations (bank safe, family members, cloud storage, work, attorney). Need any 3 to recover. Fire only affects 1-2 locations.
Scenario 2: The Media Archive Decades of family photos/videos on encrypted drives. You forget where you wrote down the LUKS passphrase, main storage fails.
With secret sharing: Drive encryption key split so family members can coordinate recovery even if you're not available.
Scenario 3: The Cloud Backup Your duplicity-encrypted cloud backup protects everything, but the encryption key is only in one place. Lose it = lose access to cloud copies of your entire hoard.
With secret sharing: Cloud backup key distributed so you can always recover, even if primary systems fail.
Implementation for Data Hoarders
What gets protected:
- Borg/restic repository passphrases
- LUKS/BitLocker volume keys for archive drives
- Cloud backup encryption keys (rclone crypt, duplicity, etc.)
- Password manager master passwords/recovery keys
- Any other "master keys" that protect your data hoard
Distribution strategy for hoarders:
bash
# Example: 3-of-5 scheme for main backup key
# Share 1: Bank safety deposit box
# Share 2: Parents/family in different state
# Share 3: Best friend (encrypted USB)
# Share 4: Work safe/locker
# Share 5: Attorney/professional storage
Each share is self-contained - includes the recovery software, so even if GitHub disappears, you can still decrypt your data.
Technical Details
Pure Python implementation:
- Runs completely offline (air-gapped security)
- No network dependencies during key operations
- Cross-platform (Windows/macOS/Linux)
- Uses industry-standard AES-256-GCM + Shamir's Secret Sharing
Memory protection:
- Secure deletion of sensitive data from RAM
- No temporary files containing keys
- Designed for paranoid security requirements
File support:
- Protects any file type/size
- Works with text files containing passphrases
- Can encrypt entire keyfiles, recovery seeds, etc.
- Backup strategies: How do you currently protect your backup encryption keys?
- Long-term thinking: What's your plan if you're not available and family needs to access archives?
- Geographic distribution: Anyone else worry about correlated failures (natural disasters, etc.)?
- Other use cases: What other "single point of failure" problems do data hoarders face?
Why I'm Sharing This
Almost lost access to 8 years of borg backups when our main password manager got corrupted and couldn't remember where we'd written the paper backup. Spent a terrifying week trying to recover it.
Realized that as data hoarders, we spend so much effort on redundant storage but often ignore redundant access to that storage. Mathematical secret sharing fixes this gap.
The tool is open source because losing decades of collected data is a problem too important to depend on any company staying in business.
As a sysadmin/SRE who manages backup systems professionally, I've seen too many cases where people lose access to years of data because of encryption key failures. Figured this community would appreciate a solution our team built that addresses the "single point of failure" problem with backup encryption keys.
The Problem: Most of us encrypt our backup drives - whether it's borg/restic repositories, encrypted external drives, or cloud backups. But we're creating a single point of failure with the encryption keys/passphrases. Lose that key = lose everything. House fire, hardware wallet failure, forgotten password location = decades of collected data gone forever.
Links:
Context: What I've Seen in Backup Management
Professional experience with backup failures:
- Companies losing access to encrypted backup repositories when key custodian leaves
- Families unable to access deceased relative's encrypted photo/video collections
- Data recovery scenarios where encryption keys were the missing piece
- Personal friends who lost decades of digital memories due to forgotten passphrases
Common data hoarder setups I've helped with:
- Large borg/restic repositories (10-100TB+)
- Encrypted external drive collections
- Cloud backup encryption keys (duplicity, rclone crypt)
- Media archives with LUKS/BitLocker encryption
- Password manager master passwords protecting everything else
The encryption key problem: Each repository is protected by a strong passphrase, but those passphrases were stored in a password manager + written on paper in a fire safe. Single points of failure everywhere.
Mathematical Solution: Shamir's Secret Sharing
Our team built a tool that mathematically splits encryption keys so you need K out of N pieces to reconstruct them, but fewer pieces reveal nothing:
bash# Split your borg repo passphrase into 5 pieces, need any 3 to recover
fractum encrypt borg-repo-passphrase.txt --threshold 3 --shares 5 --label "borg-main"
# Same for other critical passphrases
fractum encrypt duplicity-key.txt --threshold 3 --shares 5 --label "cloud-backup"
Why this matters for data hoarders:
- Disaster resilience: House fire destroys your safe + computer, but shares stored with family/friends/bank let you recover
- No single point of failure: Can't lose access because one storage location fails
- Inheritance planning: Family can pool shares to access your data collection after you're gone
- Geographic distribution: Spread shares across different locations/people
Real-World Data Hoarder Scenarios
Scenario 1: The Borg Repository Your 25TB borg repository spans 8 years of incremental backups. Passphrase gets corrupted on your password manager + house fire destroys the paper backup = everything gone.
With secret sharing: Passphrase split across 5 locations (bank safe, family members, cloud storage, work, attorney). Need any 3 to recover. Fire only affects 1-2 locations.
Scenario 2: The Media Archive Decades of family photos/videos on encrypted drives. You forget where you wrote down the LUKS passphrase, main storage fails.
With secret sharing: Drive encryption key split so family members can coordinate recovery even if you're not available.
Scenario 3: The Cloud Backup Your duplicity-encrypted cloud backup protects everything, but the encryption key is only in one place. Lose it = lose access to cloud copies of your entire hoard.
With secret sharing: Cloud backup key distributed so you can always recover, even if primary systems fail.
Imp...
Content cut off. Read original on https://old.reddit.com/r/DataHoarder/comments/1lx2my0/protecting_backup_encryption_keys_for_your_data/
