How Does Vinchin Encryption Work?

1. Feature Principle Explanation

Vinchin implements comprehensive encryption to protect data at every stage—whether stored on disk, used for system authentication, or transmitted over the network.

• Storage & Login Encryption (Data-at-Rest)
  The solution uses the AES-256-CBC algorithm, provided by OpenSSL . Plaintext data is first divided into 128-bit blocks and padded to a full block boundary. Each plaintext block is XORed with the previous ciphertext block before AES encryption; the very first block is XORed with a randomly generated Initialization Vector .
  This chained XOR mechanism ensures that identical plaintext segments produce completely different ciphertext, while the random IV guarantees that every encryption operation yields unique output.
  Applied to:
  – Backup data encryption: All backup files are encrypted before being written to the storage repository.
  – System login encryption: Sensitive authentication data  stored within the backup system is protected using the same AES-256-CBC mechanism.

• Transmission Encryption 
  All data moving between Vinchin components or to external destinations is secured using the OpenSSL TLS protocol. The negotiated cipher suite combines:
  – RSA – for key exchange and server/client authentication,
  – AES – for symmetric encryption of the transmitted data stream,
  – SHA-256 – for integrity verification and message authentication.
  Since TLS operates as a secure channel protocol, it does not expose fixed block-length or key-length parameters—the handshake dynamically agrees on the strongest mutually supported algorithms.

2. How to Configure Encryption in the Vinchin System

Step 1: Configure data encryption in job

When creating a backup job:

1. In the Backup Strategies step, expand General Strategy.

2. Under Data Storage Protection, enable Data Encryption.

3. By default, it select the encryption algorithm AES-256 and random password. If you need to set a password, you must disable the Random Password option, enter a password, and confirm it.

Step 2: Enable  data transmission

1. When creating a backup job:

   1. In the Backup Strategies step, expand Transmission Strategy.

   2. Enable the Backup Proxy, select the proxy. If there are no available agent is currently present. Please go to Resource - Infrastructure page to add one.

   3. Enable the Encrypted Transfe, by default, it select the encryption algorithm AES-256.