def validate_encryption_settings(backup_set, manifest):

        """

        When restarting a backup, we have no way to verify that the current

        passphrase is the same as the one used for the beginning of the backup.

        This is because the local copy of the manifest is unencrypted and we

        don't need to decrypt the existing volumes on the backend.  To ensure

        that we are using the same passphrase, we manually download volume 1

        and decrypt it with the current passphrase.  We also want to confirm

        that we're using the same encryption settings (i.e. we don't switch

        from encrypted to non in the middle of a backup chain), so we check

        that the vol1 filename on the server matches the settings of this run.

        """

        vol1_filename = file_naming.get(backup_type, 1,

                                        encrypted=globals.encryption,

                                        gzipped=globals.compression)

        if vol1_filename != backup_set.volume_name_dict[1]:

            log.FatalError(_("Restarting backup, but current encryption "

                             "settings do not match original settings"),

                           log.ErrorCode.enryption_mismatch)

        # Settings are same, let's check passphrase itself if we are encrypted

        if globals.encryption:

            fileobj = restore_get_enc_fileobj(globals.backend, vol1_filename,

                                              manifest.volume_info_dict[1])

            fileobj.close()

        validate_encryption_settings(globals.restart.last_backup, mf)