Online backup of secret keys in crypted zip

Question

I want to have an online backup of my private keys and other sensitive information.

Which realistic attack vectors do I expose myself to by:

1. making a zip containing the keys
2. symmetrically crypting the zipfile (ccrypt in my case)
3. sftping it to my server?

Answer 1

Your keys will be exposed if an attacker

1. is able to get hold of the encrypted key information and
2. is able to actually read the keys.

The scope of (1) is not different from any other information on the server. To read the keys (2) several things might happen (also be aware that the private keys are already encrypted by GnuPG if protected with a passphrase, so an attacker will have to get around both ccrypt and the OpenPGP private key encryption):

• keys not encrypted properly due to user mistake
• passphrase exposed due to user mistake
• passphrase can be brute-forced
• issue with the encryption algorithm
• issue with the implementation in ccrypt

Only you can decide whether these risk seem acceptable. Personally, I would not upload key backups, also not in encrypted form but store them safely and disconnected (they don't change often, anyway).