1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"
5 <!-- entities files to use -->
6 <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
10 <refentry id='amcrypt-asym-ossl.8'>
13 <refentrytitle>amcrypt-ossl-asym</refentrytitle>
14 <manvolnum>8</manvolnum>
17 <refname>amcrypt-ossl-asym</refname>
18 <refpurpose>crypt program for &A; asymmetric data encryption using OpenSSL</refpurpose>
20 <!-- body begins here -->
23 <command>amcrypt-ossl-asym</command>
24 <arg choice="opt">-d</arg>
28 <title>DESCRIPTION</title>
30 &amcryptosslasym; uses <emphasis remap='B'>OpenSSL</emphasis> to
31 encrypt and decrypt data. OpenSSL is available from <ulink
32 url="http://www.openssl.org/">www.openssl.org</ulink>. OpenSSL
33 offers a wide variety of cipher choices (&amcryptosslasym; defaults
34 to 256-bit AES) and can use hardware cryptographic accelerators on
38 &amcryptosslasym; will search for the OpenSSL program in the following
39 directories: /bin:/usr/bin:/usr/local/bin:/usr/ssl/bin:/usr/local/ssl/bin.
43 <title>GENERATING PUBLIC AND PRIVATE KEYS</title>
45 RSA keys can be generated with the standard OpenSSL commands, e.g.:
49 $ openssl genrsa -aes128 -out backup-privkey.pem 1024
50 Generating RSA private key, 1024 bit long modulus
52 Enter pass phrase for backup-privkey.pem: <emphasis remap='I'>ENTER YOUR PASS PHRASE</emphasis>
53 Verifying - Enter pass phrase for backup-key.pem: <emphasis remap='I'>ENTER YOUR PASS PHRASE</emphasis>
55 $ openssl rsa -in backup-privkey.pem -pubout -out backup-pubkey.pem
56 Enter pass phrase for backup-privkey.pem: <emphasis remap='I'>ENTER YOUR PASS PHRASE</emphasis>
61 To generate a private key without a passphrase, omit the
62 <option>-aes128</option> option. See
63 <citerefentry><refentrytitle>openssl_genrsa</refentrytitle><manvolnum>1</manvolnum></citerefentry>
64 for more key generation options.
67 Note that it is always possible to generate the public key from the
72 <title>KEY AND PASSPHRASE MANAGEMENT</title>
74 &amcryptosslasym; uses the <emphasis remap='I'>public key</emphasis>
75 to encrypt data. The security of the data does not depend on the
76 confidentiality of the public key. The <emphasis remap='I'>private
77 key</emphasis> is used to decrypt data, and must be protected.
78 Encrypted backup data cannot be recovered without the private key.
79 The private key may optionally be encrypted with a passphrase.
82 While the public key must be online at all times to perorm backups,
83 the private key and optional passphrase are only needed to restore
84 data. It is recommended that the latter be stored offline all other
85 times. For example, you could keep the private key on removable media,
86 and copy it into place for a restore; or you could keep the private
87 key online, encrypted with a passphrase that is present only for a
91 OpenSSL's key derivation routines use a salt to guard against
92 dictionary attacks on the pass phrase; still it is important to pick
93 a pass phrase that is hard to guess. The Diceware method (see <ulink
94 url="http://www.diceware.com/">www.diceware.com</ulink>) can
95 be used to create passphrases that are difficult to guess and easy to
101 <variablelist remap='TP'>
103 <term>/var/lib/amanda/backup-privkey.pem</term>
106 File containing the RSA private key. It should not be readable
107 by any user other than the &A; user.
112 <term>/var/lib/amanda/backup-pubkey.pem</term>
115 File containing the RSA public key.
120 <term>/var/lib/amanda/.am_passphrase</term>
123 File containing the passphrase. It should not be readable by
124 any user other than the &A; user.
131 <title>SEE ALSO</title>
134 <refentrytitle>amanda</refentrytitle>
135 <manvolnum>8</manvolnum>
138 <refentrytitle>amanda.conf</refentrytitle>
139 <manvolnum>5</manvolnum>
142 <refentrytitle>openssl</refentrytitle>
143 <manvolnum>1</manvolnum>
146 <refentrytitle>amcrypt-ossl</refentrytitle>
147 <manvolnum>8</manvolnum>