7

I've been using a GPG key for awhile (mostly with the pass password manager but also some with mail). Since it's now in use, a few years old, and entering the passphrase is getting tiresome, I thought I'd update/upgrade it with a new key and a shiny new Yubikey.

Preparing to change over to new GPG-key - what to do with my old ones?

was quite helpful, but didn't mention how to handle data encrypted with the previous key(s). Is decrypting old data is going to require me to enter the passphrase to my old keys? If so, is there any way to replace the passphrase-encryption with encryption using my new key (that's stored on my yubikey)?

pjz
  • 121
  • 4
  • In general systems that encrypt data and have the capability of change the encryption password needs to decrypt the old files and encrypt with the new encryption password (if you want to access your data with the new password). Depends on how they implement this "re-encryption process" the process is time consuming or not, take into account that re-encrypt a database for example could be time consuming, some files like your case will be very easy. – camp0 Jun 07 '19 at 07:48
  • I'm hoping gpg can do something smart like encrypt my old private key with my new one so I can ditch the old passphrase, at least. I understand that app-specific encryption is going to turn into app-specific re-encryption if I want to not have to carry my old key with me. – pjz Jun 07 '19 at 14:18

1 Answers1

1

I think you are mixing and, possibly, confusing two different concepts:

1 .- Using a Yubikey (or similar) for ease of use vs typing a long passphrase.

Yes, that's good, and has some other advantages (and inconveniences too). Go for it, but you need not change your key, just load your current one in the Yubikey. And just make sure you also keep you key in "normal" form for the day the Yubikey is lost or broken.

2 .- Moving to a new key. You don't need to for the simple fact of using a hardware token. If you do it, be it for other reasons. Don't do it just because of buying a hardware token.

And, lastly, if you want to have a new key and the advantages of a hardware token and also need to work with your old key, why not buy two tokens, one for the new key and one for the old one?

Toni Homedes i Saun
  • 183
  • 8
  • I grok they're two different concepts - I just don't understand how their intersection is going to work at a nuts-and-bolts level: I'm guessing a new key means a new keyring? and so if I add my old key to my new keyring, I'll be able to use it to decrypt old data - but will it require the old passphrase? or will moving it (importing it?) to the new keyring re-encrypt the old private key with the new one so the old passphrase won't be needed anymore? – pjz Jun 10 '19 at 23:09