The Problem

(may be skipped)

I'm thinking about transitioning to an improved backup solution in the long-term compared to what I did until now (which is documented in my other question).
So in short, I'm looking for a software that can do backups to various services / sites using strong encryption where the decryption keys reside in a hardware security module.

The specific requirements:

  • Must support public key encryption of the data using public keys of any format (no restriction to PGP key format especially)
  • Must not need access to the decryption key during the backup process
  • Must support at least basic backup targets (FTP, FTPS, WebDAV, local filesystem)
  • Must offer the option to sign the backups to avoid fraudelent data being restored
  • Must run on common Linux distributions or Windows (10)
  • Really should run on Windows (10)
  • Really should support usual backup targets (S3, Glacier, OneDrive, Google Drive, ...)
  • Really should support hardware based decryption (via either Java, PKCS#11, CAPI or CNG) for data restoration
  • Should offer a way to let the signature key reside in hardware (and just gets the PIN supplied) and access the hardware via either Java, PKCS#11, CAPI or CNG
  • May offer assistance (specific GUI) for the PKI operations for certifying signature keys allowed for backups
  • May offer a GUI for managing the backups (config files and command line are also OK)
  • May be open-source
  • If not open-source, price isn't an issue (the hardware will be much more expensive anyways)
  • Security audits / security certifications are a bonus, but not a requirement


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.