On of the things I want to do with backups is to add encryption of files inside the archive, mainly database and some of source files at least. But, web servers and PHP is not really well suited to handle any type of encryption due to complexity and limited resources for such operations.
I am looking into different solutions for encryption, and as it looks now, PHP mcrypt extension is best solution of this. Problem is that servers can be set up without this extension installed. Other solutions are much slower than mcrypt that on its own is slow already. Tests I did show that the even the simplest encryption can slow the process 20 or more times. Also, encrypting a single file requires memory, so that also limits the amount of data PHP can handle for this. Problem with encryption in PHP is that must be in memory operation. If you need to encrypt the file, that file must be loaded, encrypted and saved. There are no stream based functions, partial encodings and things like that in PHP. Also, in most cases PHP can be assigned maximum of 256MB of RAM, new servers, new PHP versions allow up to 4GB (as far as I know).
At this point I am thinking of encrypting database data. Encrypting PHP files can be pretty pointless, since most of the installation is WordPress, themes and plugins that don’t hold anything worth encoding. And to encode uploaded files, images, videos and things like that will be very complex to do and again, limiting by the size.
To encrypt database data there are few approaches to it. If the backup is done using mySQL dump, only way to make encryption is to encrypt the database file. But, to do that, file must be smaller than 100MB (with GZIP that can be achieved). 100MB GZIP SQL file can hold typically up to 500 MB database. So, big websites can’t use this method. For instance, Dev4Press website right now has 100MB database, packed in under 15 MB GZIP. The whole file is encrypted after backup. If database backup is made using SQL functions in plugin, encryption can be done same way as described before on the completed file. But, also, I can attempt to encrypt parts of the data before writing them into file. This will be very complicated to do, but it is doable.
Encrypting files can be done also, but the more files to encrypt, the slower the backup process will be. Dev4Press website, full backup takes about 3 minutes to backup everything (500 MB). From encryption tests I did, for 100% encryption this can take up to an hour or even more, with also high CPU usage during this period, and that can leave your website unresponsive.
So, what to do? I am open to suggestions on how to handle encryption for backups. If you have examples on how to handle large file encryption, tips on how to do it, or suggestions on what to encrypt, how to go around PHP limitations, please leave comments, or contact me directly if needed.
