Skip to main content

Is Acronis AES encryption backdoored?

Thread needs solution

Hello,

Recently i read following text in the EULA:

The eula is shipped with every true image instance:

"Acronis will not decrypt your files unless (a) it reasonably believes that it must do so to troubleshoot problems with the Software or Services; or (b) it reasonably believes it must do so in order to comply with any law, subpoena, warrant, order, or regulation.  Acronis may also provide access to your data to government authorities if Acronis suspects or believes that the data contains child pornography or other prohibited content or data or that the Data is being used for illegal purposes. You acknowledge that Acronis or Acronis affiliates may use servers and other equipment to provide the Software or Services that are located in the United States or in other countries where litigants, law enforcement, courts, and other agencies of the government may have the right to access data stored within their jurisdictions upon terms and conditions provided by local law, and that, as a result, they may gain access to your backup data as provided by applicable local law."

 

Does it essentially mean that AES encryption utlized in acronis true image is backdoored and cannot be trusted?

 

https://security.stackexchange.com/questions/153553/is-acronis-true-ima…

https://forum.acronis.com/forum/acronis-true-image-2015-forum/backup-cl… (question has been asked and no staff answer, since 2 years - does it means it's backdoored?

 

Here's quote from that thread:

 

"

And we are also waiting for an update why it is documented on the EULA that we can decrypt it.[/quote]

I've been promised an update the latter point and answers to my other questions by next week and will update this thread again when I get the, in case this information is helpful to others."

0 Users found this helpful

Mark, welcome to these user forums.

An interesting question that you have raised in this topic and if I am being totally honest, I would be guessing as to what answer to give you, as only Acronis can provide a definitive statement on this question.

I will drop a PM to Gaidar, as General Manager for Acronis True Image and ask that he review this topic and respond / get someone to respond who can try to answer the question(s).

Regular Poster
Posts: 198
Comments: 120

This will be an interesting answer....

I suspect that most will agree that the statement below means  "yes" they can, if needed,  but why would a business tell anyone that they could decrypt.  People would not like that.... But it is a Public Cloud... I suspect hackers and peepers just love the cloud.  Not for me or my business.

"Acronis will not decrypt your files unless (a) it reasonably believes that it must do so to troubleshoot problems with the.....

will be watching the replies to this one....

Steve F.

I'm more interested if they can decrypt the "local" decryption, the cloud is obvious.

The local encryption mechanism should encrypt file before it's uploaded anywhere. If this is backdoored, then it's non-sense, and governament (NSA) might access your data since there's some sort of "master-key" according to acronis EULA claims.

Anyway, waiting for answer.

 

 

There are two situations possible:

  • If a user enables encryption on the client, then the encryption is done by the agents (Acronis True Image or Acronis Backup) on the machine being backed up, using the encryption key/passphrase provided by the user. In this case, Acronis has no means to decrypt the data.
  • If a user uploads unencrypted data, then the data are encrypted on the server for storage, using a key stored on the server. In this case, authorities have a right to request to decrypt the data, and Acronis will have to comply.

In both cases, data-in-transit are encrypted using SSL.

Acronis is very serious about the security of the data, and we use industry best encryption best practices and do not have backdoors.

I hope this clarifies the situation. 

Gaidar, many thanks for your clarification of this serious question.  

May I ask one further point of clarification please: Your second point starts: If a user uploads unencrypted data...

So, am I correct in thinking that If a user uploads encrypted data, i.e. has applied a password and chosen a level of encryption using the options on the Advanced Options page of the ATIH task configuration, then this is the same as the first case where you stated, that Acronis has no means to decrypt the data?

Yes. If a user uploads encrypted data - then the encryption is entirely in the hands of the user. We do not upload information that would allow us to restore the encryption key, only the data.

Thanks again Gaidar, that sounds very clear to me, now to wait for the OP to give his response.

Sure! And feel free to reach out to me directly at gm@ acronis.com