--encrypt

Encrypt the data when creating a backup image by a backup-to-image operation, or when packing a backup directory into a single file with the backup-dir-to-image subcommand. It cannot be used with the backup or backup-and-apply-log subcommand.

--decrypt

Decrypt an encrypted backup image when performing an extract, image-to-backup-dir, or copy-back-and-apply-log operation. It is also used for performing a validate or list-image operation on an encrypted backup image.

The option cannot be used in a apply-log, backup-and-apply-log, or copy-back operation. For restoration using the copy-back subcommand, the encrypted backup image has to be unpacked and decrypted first using the image-to-backup-dir or extract subcommand, together with the --decrypt option.

--key=STRING

The symmetric key for encryption and decryption of a backup image. It should be a 256-bit key, encoded as a string of 64 hexadecimal digits. See Chapter 8, Encryption for Backups on how to create a key. The option is incompatible with the --key-file option.

--key-file=PATH

The pathname to file that contains a 256-bit key, encoded as a string of 64 hexadecimal digits, for encryption and decryption of a backup image. The option is incompatible with the --key option.