The backup file generated by the clusterctl backup create command is encrypted using:

• The AES-256 symmetric encryption algorithm.
• An encryption key derived from the password supplied through the --password parameter. The provided password is not used directly as the encryption key; it is transformed into the key using SHA-256, together with an 8-byte random salt and multiple iterations.