Allow multiple passphrases for repo key

[quazgar]

Feature request

It would be nice if it was possible to have multiple pass phrases for the key to a Borg repo. Much like for LUKS disc encryption.

My use case

In our company we would like to have encrypted backups for all employees, where the employees can choose their own passphrase, but also also the IT administration needs to be able to access the backups in case of an accident/vacation/resignation.

Workaround

What we currently do:

• IT administration creates repository on backup server, with passphrase 1.
• Export of repo key.
• Employee gets access to repository, changes passphrase to their own.
• If necessary, IT copies repo to another place and uses the backed up repo key to access the data.

This of course is quite cumbersome and not really feasible for regular health checks of the repository.

[ThomasWaldmann]

borg 1.x: no change planned (risk of bugs, old codebase, code in borg2 already different)

borg2:

• repokey: guess we can store multiple keys into the repository under keys/<sha256(key_content)>
• keyfile: we already support having multiple keys in the keys directory
• using the content hash as name enables strong checksumming to detect accidental corruption
• the key format would be same as we have now in borg2 (argon2id, chacha20-poly1305 AEAD encrypted key material)
• we would have multiple keys that encrypt the same secret key material using different passphrases and salts
• after the key passphrase is given, it would find matching keys for the repoid wanted (keyfile mode) and take the first key that can be decrypted with the given passphrase
• plus some more key mgmt commands to add and remove keys
• the initial key would get an "admin" label and be prohibited from deletion
• additional keys would get a user-defined label and can be deleted without knowing their passphrase

[ThomasWaldmann]

Note: implemented it using multiple keys rather than one key with multiple passphrases.

As all the keys contain the same secret key material, this also adds redundancy, in case a key gets lost or corrupted.

[quietquark]

@ThomasWaldmann - A question/suggestion - would it be possible/doable to have passwords that correspond to keys that only grant append permissions?

This would be a great way to automagically protect repos based on an "admin" password vs a "backup-only" password (and/or even a "prune-enabled" password).