Re: splitting key across machines

[Arnt Gulbrandsen <arnt@gulbrandsen.priv.no>]

On Wednesday, May 7, 2014 11:33:55 AM CEST, Colin Percival wrote:
> The syncing needs to go both ways -- deletes need to know how 
> many archives use
> each block, so they can figure out which blocks are no longer needed 
after a
> delete is finished, and creates need to know which blocks exist.

In which case the original poster probably should think hard about doing 
this.

Suppose a fun-loving attacker gains access to the server that makes the 
backups and manipulates the cache to set all the refcounts to 1, then waits 
for the OP to sync the cache to the host that can delete. When the OP 
syncs, the attacker laughs like a hollywood villain, turns off the OP's own 
access to the server, phones the OP and says "your backups are no good any 
more. Paypal me $x in ten minutes or I wreck the server, too."

tarsnap --fsck seems a suitable alternative.

Arnt