Synology NAS encryption, essential data to retain
Discussion
Does anyone here run a Synology NAS with encryption?
I'm just a bit confused about what data to store to retain the defacto encryption data should I need to restore.
It seems storing the keys on a USB stick is the best way to go for all sorts of reasons so I'm going with that solution.
But just as a test I've done this:
On creating a share:
Share name: test1
encyption key: 12345678
don't save to key manager
save to file test1.key
Right click on share, encryption, export key, enter encryption key (12345678), save file to test2.key
Both key files are different contents.
I can remount the encryption with 12345678, or with either of the two different key files.
If I create a new share, test2, same encryption key as above, and re-run the process, with encryption key 12345678 etc.
Then two new key files are created, both unique from each other again, and from the original pair from test1.
All four keys (generated from 12345678) will decrypt/mount both test1 and test2.
From this test then, I assume that if I ever decided to mount my drives in a linux system that the actual decryption key is indeed "12345678"?
The exported files are just different because of something Synology is doing... they are all actually acceptable variants of the same key 12345678?
I can use just one key to decrypt all my encrypted shares?
I can store just one of the key files/actual key (12345678), not multiple versions of key files?
The intention is that I just want to encrypt all my shares, and just keep one "password" in my keepass database.
It seems that I can use a 128 bit hex generated 'encryption key' from keepass and use it for all my Synology shares.
I'd then need to 'password protect' the USB stick key contents with another password (but in practice if this is broken then the contents are readable, so this password may as well be the same 128 bit hex key too)
Am I madder than a box of frogs, or does this sound like a logical path to take?
I like the idea of storing the keys on the Synology NAS, but it's not clear if the machine key cypher just adds a cypher to the encryption key you provide (12345678) so that the locally stored keys aren't readable, but usable... or if the actual data is encrypted with this new cyphered key, thus needing the cyphered key to be stored etc...
Can anyone clarify which key is actually used to encrypt the shares in all cases?
Is it *just* the user entered "encryption key" that is the key required to decrypt in any circumstance? Ie, on that same NAS, another new NAS, a linux mount, etc.
Many thanks for any input!
Dave
I'm just a bit confused about what data to store to retain the defacto encryption data should I need to restore.
It seems storing the keys on a USB stick is the best way to go for all sorts of reasons so I'm going with that solution.
But just as a test I've done this:
On creating a share:
Share name: test1
encyption key: 12345678
don't save to key manager
save to file test1.key
Right click on share, encryption, export key, enter encryption key (12345678), save file to test2.key
Both key files are different contents.
I can remount the encryption with 12345678, or with either of the two different key files.
If I create a new share, test2, same encryption key as above, and re-run the process, with encryption key 12345678 etc.
Then two new key files are created, both unique from each other again, and from the original pair from test1.
All four keys (generated from 12345678) will decrypt/mount both test1 and test2.
From this test then, I assume that if I ever decided to mount my drives in a linux system that the actual decryption key is indeed "12345678"?
The exported files are just different because of something Synology is doing... they are all actually acceptable variants of the same key 12345678?
I can use just one key to decrypt all my encrypted shares?
I can store just one of the key files/actual key (12345678), not multiple versions of key files?
The intention is that I just want to encrypt all my shares, and just keep one "password" in my keepass database.
It seems that I can use a 128 bit hex generated 'encryption key' from keepass and use it for all my Synology shares.
I'd then need to 'password protect' the USB stick key contents with another password (but in practice if this is broken then the contents are readable, so this password may as well be the same 128 bit hex key too)
Am I madder than a box of frogs, or does this sound like a logical path to take?
I like the idea of storing the keys on the Synology NAS, but it's not clear if the machine key cypher just adds a cypher to the encryption key you provide (12345678) so that the locally stored keys aren't readable, but usable... or if the actual data is encrypted with this new cyphered key, thus needing the cyphered key to be stored etc...
Can anyone clarify which key is actually used to encrypt the shares in all cases?
Is it *just* the user entered "encryption key" that is the key required to decrypt in any circumstance? Ie, on that same NAS, another new NAS, a linux mount, etc.
Many thanks for any input!
Dave
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff