state the consequences of disabling integrity checks in rescue and recovery mode

[python-delta-tar] / docs / recovery.rst

diff --git a/docs/recovery.rst b/docs/recovery.rst
index f05283e..11fc47b 100644 (file)
--- a/docs/recovery.rst
+++ b/docs/recovery.rst
@@ -35,3 +35,14 @@ look like this:
 
 Needless to say, care must be taken to inspect the files reported damaged.
 
+Security considerations
+-------------------------------------------------------------------------------
+
+With encrypted backup sets, recovery mode omits the GCM authentication tag on
+ciphertext. This introduces a severe flaw in that bad initalization vectors
+will no longer cause decryption to fail. An attacker controlling the backup
+sets (e. g. after subverting the file server) can exploit this to recover
+plaintext from encrypted objects. Thus recovery mode should only ever be used
+as the last resort when dealing with known corrupted files. The decrypted
+result must be conscientiously inspected for manipulation attempts.
+