NAME

tarsnap-recrypt —

re-encrypts data stored using tarsnap(1)

SYNOPSIS

tarsnap-recrypt --oldkey old-key-file --oldcachedir old-cache-dir --newkey new-key-file --newcachedir new-cache-dir

tarsnap-recrypt --version

DESCRIPTION

tarsnap-recrypt downloads and decrypts data using old-key-file and re-encrypts and uploads it using new-key-file. After all the data has been re-uploaded, tarsnap-recrypt deletes the data using old-key-file so that the only remaining copy of the data is encrypted using new-key-file. The key file new-key-file must have been generated by tarsnap-keyregen(1) with old-key-file.

tarsnap-recrypt checkpoints its progress after every 1-2 GB of data that it has copied; if it is interrupted it can be re-run and it will attempt to continue.

Note that after tarsnap-recrypt completes it will be possible to store more archives using the key old-key-file and the cache directory old-cache-dir so care should be taken to disable any automatic (e.g., cron(8)) archiving while tarsnap-recrypt is run.

The --version option prints the version number of tarsnap-recrypt, then exits.

EXAMPLES

The following sequence of commands will create new keys and re-encrypt data, assuming that the currently used keys are in /root/tarsnap.key and the current cache directory is /usr/local/tarsnap-cache:

tarsnap-keyregen
  --keyfile
  /root/tarsnap.key.new --oldkey
  /root/tarsnap.key --user
  me@example.com --machine
  myserver

tarsnap-recrypt
  --oldkey /root/tarsnap.key
  --oldcachedir
  /usr/local/tarsnap-cache
  --newkey /root/tarsnap.key.new
  --newcachedir
  /usr/local/tarsnap-cache.new

rm
  -r
  /usr/local/tarsnap-cache

mv
  /usr/local/tarsnap-cache.new
  /usr/local/tarsnap-cache

rm
  /root/tarsnap.key

mv
  /root/tarsnap.key.new
  /root/tarsnap.key