The Problem

(may be skipped)

I'm thinking about transitioning to an improved backup solution in the long-term compared to what I did until now (which is documented in my other question).
So in short, I'm looking for a software that can do backups to various services / sites using strong encryption where the decryption keys reside in a hardware security module.

The specific requirements:

  • Must support public key encryption of the data using public keys of any format (no restriction to PGP key format especially)
  • Must not need access to the decryption key during the backup process
  • Must support at least basic backup targets (FTP, FTPS, WebDAV, local filesystem)
  • Must offer the option to sign the backups to avoid fraudelent data being restored
  • Must run on common Linux distributions or Windows (10)
  • Really should run on Windows (10)
  • Really should support usual backup targets (S3, Glacier, OneDrive, Google Drive, ...)
  • Really should support hardware based decryption (via either Java, PKCS#11, CAPI or CNG) for data restoration
  • Should offer a way to let the signature key reside in hardware (and just gets the PIN supplied) and access the hardware via either Java, PKCS#11, CAPI or CNG
  • May offer assistance (specific GUI) for the PKI operations for certifying signature keys allowed for backups
  • May offer a GUI for managing the backups (config files and command line are also OK)
  • May be open-source
  • If not open-source, price isn't an issue (the hardware will be much more expensive anyways)
  • Security audits / security certifications are a bonus, but not a requirement


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.