It's been five years since I created my Unix password store, encypted with my GPG key pair password-store. That key expired and now I need to update my database to a new master key.

Now is also a good time to clear out the git history. My key has not (to my knowledge) been compromised, so I don't need to remove all instances of passwords encrypted with the old key, but it will be nice to clear out the old history.

Here are the steps I performed to generate a new key pair and reencrypt the password store with it.

Generate a new key

I created a new key without an expiry date. This is maybe controversial, but I don't intend to share the key with anyone, so I feel it's better to not have to do this again unless the key is compromised.

To do this, I ran:

gpg --full-generate-key

Then answered 0 to Please specfy how long the key should be valid. This means it does not expire at all.

It's necessary to give the new key a different name to the old one, so that I can have both of them on my key chain together when reencrypting. I went with passwords-master as as the "real name".

Following generating new key, I saved it and shared it to my other devices as explained in 2018.

Reencrypt password store

I followed these steps to remove history and reencrypt.

Remove the current ~/.password-store directory
Shallow clone from GitLab:

git clone --depth 1 git@gitlab.com:milohax/pass.git .password-store
Reencrypt by specifying the new passwords-master gpg-id:

pass init passwords-master

This prompts for the old key's passphrase to decrypt. It will note the key ID of the key it's reencrypting with.
Verify by decripting a password. This will prompt for the passphrase of the new key
Force-push to GitLab:

pass git push --force origin master

Update on other machines

Each other machine needs to do a fresh pull, and import the new key onto the device's key chain. This was spelled out in the earlier post, but here are the high-level steps and commands.

Export the public key:

gpg --export --armour passwords-master > passwords-master.sec.asc
Then, append the private key:

gpg --export-secret-keys --armour passwords-master >> passwords-master.sec.asc
Don't forget to encrypt the ASCII file with the device key if you're sending by email:

gpg --trust-model always -e -r milo-nokia6.1 passwords-master.sec.asc
Then send the .gpg file, not the .asc

With the new key on the keychain, and the updated password-store, you can now view a password entering the new key's passphrase.