Re: DAR encryption

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 17/07/2020 20:00, Moti Renkosinski wrote:
> I have been using an old version of DAR (2.4.2) to back up some
> data.  I tried to restore one of my backups the other day and it is
> asking me for an encryption password.  This backup was done a long
> time ago and I no longer have access to the scripts which were used
> to create it.  I don’t remember ever enabling encryption on this
> backup.  Is there a definitive way to determine that the backup is
> encrypted?  I don’t believe it is corrupted so is there any other
> reason why DAR is indicting that this backup is encrypted even
> though I don’t believe it is?

When an archive is encrypted, dar puts an flag in the archive header
and trailer (which are both identical and stored in clear text) about
the fact the archive has been encrypted or not. Starting archive
format version 9, the trailer/header also contains the encryption
algorithm used. Here 2.4.2 uses archive format 8 so you only have a
clear/encrypted binary flag.

When reading an archive, dar reads the header or trailer and if the
flag is set, it asks for the passphrase. The crypto algorithm is taken
from the header or, if absent, from command-line else it defaults to
blowfish or to aes256 depending on dar version used (aes256 since
release 2.5.0).

- -> pay attention to that: you may have been using a 'usual password'
and fail to decrypt the archive with that 'usual password' because the
encryption algo is not provided in the archive header/trailer and you
use a recent dar version that assumes it to be aes256 while blowfish
had been used in this old format. To cope with that use the -K
bf:<pass> syntax or use 2.4.x dar binary.

You can check the archive *trailer* with a recent dar version (2.6.x)
using this command:
	dar -l <archive> -aheader

and the archive *header* with this command:
	dar -l <archive> --sequential-read -aheader

if both are identical, there is little chance a corruption took place,
and thus the archive is very probably encrypted (so you need the
algo+passphrase to decipher it). Else remove the -aheader of the
command that show the expected no-encrytion used info and see if you
can read the archive in this corresponding mode (sequential read or
direct read modes)

Regards,
Denis

>
>
>
> Thanks,
>
>
>
> Moti

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEOzEprx3d76WjfYGPCDGwvQPYsYIFAl8S9osACgkQCDGwvQPY
sYJKaQ//Z2NH8mwPeI6eWc9Drpf3ShebW8eVhqb8m/N1JW+BCZ2r/X0z1KMPgnYd
Le1W5d+AED8SN828Kb1D/u0PwsRnwPyAQuI0aszZB7BHe+h3+/74FHK2k4JwWobL
sE8TC3nlH+puWkp4l1VPgyL/gG3x+AKbTSTvYfdOeOBCy4bzrzOHW5KqMo8Huu6g
+9NCKdD+9LTCYaKjkOKf6tHbbWTR1aIwhUvkDGR/w5poGyE08StFuVZyynoYeyOl
6Ls5bM155VK/If16p0ZTyGr/zXyFiV1KiU+0nUO39DvD8k1JytVlZCMstaqz68dh
L3OO7tiPz/m7Yuy/7chrPpBRapSpWRZ9AziokF1VSq7anVNrtyHKJQRSHMqh1OqW
Lyfth1lYIE+YonSrXHLPAS9B6LX+jx5TumFjELrQZaQCp68BFMRiwDt7NzDCWBFA
JmTO/fVKSrjBg72WuScUvvTZN95oweEIC5T4i8+Ne20POCnTXXGllWDg2Tpbcnbz
oX8qaO5jjLM32o5yGDEDwcL+0ZEHaGXCc2/pDE9AnzYGRSgvXbosjKIamSUKUEZ5
79CPU0MchduTouJv/TlrBRSLJ6NAZ8H0bDIuNA07niuSpovxl1QhksUt6EgTjvsf
QemJlMd4YLNPZnPw/M44c79o81+do2pnYxN+1rwCl4XaeRQmrhk=
=Yt7R
-----END PGP SIGNATURE-----