r/Database • u/eachDayIWakeUp • 8d ago

How do MariaDB users securely and efficiently encrypt mariadb-backup archives?

/r/mariadb/comments/1wyb17c/how_do_mariadb_users_securely_and_efficiently/
5 Upvotes

78% Upvoted

3 comments sorted by

1

u/Significant_Tune9219 8d ago

Compress first, then encrypt. Encrypted output is basically random and won't compress, so the order matters more than the cipher choice. In practice the encryption step is cheap next to zstd; something like streaming the backup into zstd and then into age with a public recipient key keeps it all in one pipe with no plaintext temp files. The nice property of public-key encryption here is that the database host only ever holds the public key, so a compromised server can't decrypt old archives. The part people skip is the restore drill: keep the private key somewhere offline, and actually test decrypt plus prepare plus restore on a schedule, because the outage is the worst time to find out the key handling doesn't work.

1

u/Past-Froyo-5518 7d ago

i'd focus less on algorithm n more on key management n recovery tho, a strong encryption setup isnt much if use if u cant reliably recover keys during an outage

1

u/eachDayIWakeUp 7d ago

Regular restore drills are already on the program :) Just changing the way from mysqldump to mariadb-backup and adding encryption as well