Borg: During repo init encryption=repokey parameter is being ignored

[arjunak234]

Have you checked borgbackup docs, FAQ, and open Github issues?

Yes

Is this a BUG / ISSUE report or a QUESTION?

BUG

System information. For client/server mode post info for both machines.

Your borg version (borg -V).

borg 1.1.9

Operating system (distribution) and version.

Debian 10

"encryption" parameter is being ignored during repo init.
borg init TEST --encryption=repokey

Enter new passphrase:
Enter same passphrase again:
Do you want your passphrase to be displayed for verification? [yN]: n

By default repositories initialized with this version will produce security
errors if written to with an older version (up to and including Borg 1.0.8).

If you want to use these older versions, you can disable the check by running:
borg upgrade --disable-tam TEST

See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.

IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
Use "borg key export" to export the key, optionally in printable format.
Write down the passphrase. Store both at safe place(s).

[ThomasWaldmann]

So, where exactly is the problem?

[arjunak234]

Doesn't repokey mean i only need the passphrase not key and passphrase?

[ThomasWaldmann]

you always need key and passphrase.

the difference is that for repokey mode, the key is stored in the repo config, while for keyfile mode it is stored in your home directory.

[arjunak234]

"you will need both KEY AND PASSPHRASE" made it sound like the key is stored in home directory.

[ThomasWaldmann]

you read too much between the lines. :)
as you can read in the lines below the one you quoted, it tells you that so you keep both at a safe place.

it would be a pity if you lose the key or passphrase and can't access your repo because of that.

that can also happen if the key is stored in the repo config, just think of a hardware issue or software bug.

[DavidOliver]

New user here. I searched and found this issue after reading https://borgbackup.readthedocs.io/en/1.1-maint/usage/init.html and initialising my first repo with borg init --encryption=repokey as I was also confused/unsure.

"you will need both KEY AND PASSPHRASE to access this repo!" does seem to strongly imply that the key will need to be managed by the user separately to the remote repo (and its config). I believe it would avoid confusion if the message were tweaked based on the encryption option used, or if it were improved to more clearly cover use of both keyrepo and keyfile options.

Edit: or is the idea, even with 'keyrepo', that the user does export and the remotely-stored key? If so, is that to guard against corruption of (just) the key file on the remote, which would render the whole repo (which may otherwise still be readable) unreadable? Apologies if this is a silly question; after reading the documentation I had the idea in my head that I would only need to store the passphrase:

If you want “passphrase-only” security, use one of the repokey modes. The key will be stored inside the repository (in its “config” file).

[ThomasWaldmann]

The "you will need..." phrase is simply a statement of a fact. The repo is encrypted with a key and the key is protected by a passphrase. So you need both of them to be able to use the repo.

This fact is totally independent of the storage location of the key (whether it is local in your home directory or in the repo directory). It also does not say that you need to do something special with the key under normal circumstances, it just tries to say that you must not lose neither the key nor the passphrase under any circumstance (except if you completely delete a repo). This implies that you make a backup and store it safely as it suggests after that phrase.

If you have a better phrase to express that shortly, I am open to suggestions.

[abeluck]

I landed here the same as @DavidOliver.. this was also quite confusing to me. I was pretty sure the key was stored in the repo, but the message made me do a double take and led me here to verify.

Suggestion: leave the phrasing as is, but append a sentence to the effect of "If you used a repokey encryption mode, then the key is stored in the repo but you should back it up separately."