[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Copy/migrate archives/history with a new key?

On 8/14/25 11:04, creed-january-twig@duck.com wrote:

I *have to* change my tarsnap key (or rather, stop using the old key).

I see this https://www.tarsnap.com/tips.html#copy-archive as well but I don’t really understand what it is and what it does - but I don’t see a key mentioned in the command so I guess not like “restic copy”.


Right, that's for copying one archive, using the same keys and within the
same archival space.


This https://www.tarsnap.com/man-tarsnap-recrypt.1.html seems to be the only way, right?


Yes.  That creates a new archival space, copies everything across, and then
deletes the old copy.


Also, the original/existing key was not *passworded*, can I generate the new key as ‘--passphrased’ and then proceed with the recrypt? I am asking because I believe to re-encrypt, ‘tarsnap-keyregen’ has to be used and the key is derived from the old key.


Correct.  To be more precise, the chunking parameters are kept from the old
key but everything else is generated anew.  (The chunking parameters need to
be kept so that new data will deduplicate against the copied data.)

This also raised the question - does it render the old key useless after the re-encryption is done, or both keys have access now?


Both keys will work but they'll access different archival spaces (and the
old keys will point to an archival space with no archives after recrypt
deletes everything using the old keys).

If this is a "keys were stolen" scenario then let me know and I can disable
the old keys.

--
Colin Percival
FreeBSD Release Engineering Lead & EC2 platform maintainer
Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid