Arius encrypts all data before it leaves your machine. Azure Blob Storage never receives plaintext content. Encryption is always on — there is no opt-out.
Each file (or TAR bundle of small files) passes through the following stages in order:
Original file
│
▼
GZip (compression)
│
▼
AES-256-CBC (encryption)
│
▼
Azure Blob Storage
Cipher details
Arius uses AES-256-CBC with PKCS7 padding, derived via PBKDF2-SHA256 — identical to the default behaviour of openssl enc -aes-256-cbc -pbkdf2. This means any blob stored by Arius can be decrypted with the standard openssl CLI, with no dependency on Arius itself.
| Parameter | Value |
|---|
| Algorithm | AES-256-CBC |
| Key size | 256 bits |
| Block size | 128 bits |
| Key derivation | PBKDF2-SHA256, 10,000 iterations |
| Salt | 8 bytes, randomly generated per encryption |
| Padding | PKCS7 |
| Format | OpenSSL-compatible (Salted__ prefix + salt + ciphertext) |
Setting the passphrase
Pass the passphrase with the --passphrase flag on every archive and restore invocation:
arius archive /data \
--accountname myaccount \
--accountkey "<key>" \
--passphrase "my secret passphrase" \
--container arius
If you lose your passphrase, your data cannot be recovered. There is no key escrow, no recovery mechanism, and no way to brute-force a strong passphrase from the stored ciphertext. Store your passphrase securely before archiving any data.
Store the passphrase in a password manager (such as Bitwarden or 1Password) and, separately, in printed form kept in a physically secure location. Treat it with the same care as a private key or seed phrase.
Manual decryption with OpenSSL
Because the format is OpenSSL-compatible, you can decrypt any Arius blob without installing Arius. This is useful for disaster recovery when only the raw blobs are available.
Download the blob from Azure
Use Azure Storage Explorer or the Azure CLI to download the encrypted blob from the chunks/ folder in your container.az storage blob download \
--account-name myaccount \
--container-name arius \
--name chunks/<BinaryHash> \
--file encrypted.blob
Decrypt with OpenSSL
openssl enc -d -aes-256-cbc \
-in encrypted.blob \
-out original.file.gz \
-pass pass:"my secret passphrase" \
-pbkdf2
Decompress with gzip
gzip -d original.file.gz -f
original.file is now the restored binary, identical to what was archived.Encryption in the archive pipeline
Encryption is applied at the end of the upload pipeline in both the large-file path and the small-file TAR path:
- Large files:
Original file → GZip → AES256 → Blob Storage
- Small files (TAR batches):
Multiple files → TAR → GZip → AES256 → Blob Storage
In both cases the encrypted stream is written directly to Azure without touching disk in plaintext form. 