Borg's encryption is questionable at best. Performance wise it's not particularly good and probably will never get better because of the large, somewhat complex Python codebase.
I'm more concerned about the repository format and config file (i.e. attack surface, since the repo is potentially untrusted).
Performance is actually better than Restic, and performance-critical parts of Borg are written in C or use C libraries.
No, using one key per repository and a persistent message counter is not a reasonable design.
https://borgbackup.readthedocs.io/en/stable/internals/securi...
Edit: I've posted this a bunch of times here, pretty much every time it caught my eye when someone said this tool has good crypto, and by now I'm used to people just downvoting it and saying it doesn't matter because obviously no one ever would use it like that and the design is fine etc. (isn't the point of deduplication to save disk space?)
> If we perform similar backups to the same remote destination over SSH (Borg) and SFTP (Restic), the initial backups take roughly the same time, but the subsequent incremental backups take something like 10x longer with Restic.
Also I'm wary of encrypting personal backups. I think the chances of me forgetting a password that I used literally once are quite high, and what's the point of a backup if you can't actually access it?