Modify age identity after store is initialized

[anjos]

I have one age key that was generated with the root store when it was first created. I'd like to change that key to another one I just created.

Is it possible? What would be the workflow for this?

Thanks in advance!

[anjos]

I guess you could:

1. Add the new public key with gopass recipients add, remove the the old key, and re-encode all secrets
2. Passphrase-protect the new key, copy it over $XDG_CONFIG_HOME/gopass/age/identities

I wonder if there would not be a shortcut for this...

[AnomalRoil]

This should work as well, except for the "remove the the old key" that should come in step 3 after you have added your new key to the identitites file.

[AnomalRoil]

With the age backend, we have the gopass age command to control what's happening with your keys.

If you want to replace the original key with your own key generated outside of gopass the following should work:

1. Make sure you are running gopass 1.15.15, this won't work with v1.15.14 or lower versions since we recently greatly improved age support.
2. Add your new secret key as an identity. This will require you to give your secret age key to gopass to store in its age keyring.
   gopass age identities add
   follow the interactive prompt.
3. Add your new public key as a recipient (as instructed by the interactive prompt):
   gopass recipients add age1...
4. remove your old secret key using:
   gopass age identitites rm age1...
5. remove your old public key using:
   gopass recipients rm age1...
6. make sure your secret were properly re-encryoted to remove that key using gopass fsck --decrypt

If you want to _ change_ the passphrase of the protected keyring identities file, you will have to do it manually as you mentioned.
I think we should improve this since we could have the addition and removal of the public keys built-in the age identities commands I guess.

[anjos]

This recipe works and I'm marking it as an answer! Thanks a lot.