Feature Request - Asymmetric Encryption Support for Router Backup Files

RouterOS Security
1

Hello MikroTik Community and Development Team,

I would like to propose a feature enhancement for router backup functionality that would significantly improve security practices in production environments.

Current Limitation:
Currently, MikroTik routers only support symmetric encryption for backup files, which requires storing the encryption password directly on the production router or in the backup automation scripts. This creates a security vulnerability as the same key used for encryption must be present in the production environment for backup creation.

Proposed Enhancement:
Implement asymmetric encryption (such as PGP/OpenPGP or RSA) for backup file encryption. This would allow:

  1. Public key storage on router: Only the public key would need to be stored on the production router
  2. Private key kept secure: The private key for decryption would be stored securely offline or in a separate secure environment
  3. Enhanced security: Even if the production router is compromised, backup files remain secure since the decryption key is not present

Benefits:

  • Eliminates the need to store sensitive decryption passwords in production environments
  • Follows security best practices for backup encryption
  • Reduces attack surface - compromised routers cannot decrypt their own backup files
  • Aligns with enterprise security policies that require separation of encryption/decryption keys
  • Maintains automated backup capabilities without security trade-offs

Implementation Suggestion:
Add support for RSA or PGP public key encryption alongside the existing symmetric encryption options. This could be implemented as an additional backup encryption method in RouterOS.

Use Case:
This feature would be particularly valuable for:

  • Enterprise environments with strict security policies
  • Managed service providers handling multiple client configurations
  • Any production environment where backup security is critical

Has anyone else encountered this limitation? Would this enhancement be valuable for your deployment scenarios?

Thank you for considering this feature request. I believe it would be a significant security improvement for the MikroTik ecosystem.

Best regards
Tommy

2

Hmmm ... do you rely on router based backups only?
If you store them on the external storage with versioning applied then you can restore to any state.
Backups are the binary ones and you can restore them safely only on the same devoice. You should make "exported" backups and then versioning is an ideal tool..
Look at point #17 at GP & CSA for Mikrotik devices

3

As written already, you do not want to keep the backup files on the router. Instead you want to transfer them to another system and remove them on the router immediately afterwards.
When you are doing that anyway, you can initiate the backup procedure from the remote system using API and send the backup command and its password so it does not have to be stored locally.

4

Thank you for your reply. I just wonder that I use another device to start the backup process. Except manual type the encrypt password, we still need to keep password in production environment.

5

Yes. But of course you could make backups without encryption and do PGP encryption on your backup server, when you really consider that very important.