Rotate your key

tovio key rotate

Re-issues the attribute claims you have granted, re-seals HEAD's protected content, then swaps the key. The order matters: the swap happens last, so a crash never leaves you holding a new key with content still sealed to the old one.

When to rotate

• You suspect the key was exposed.
• A device was lost and you want to be thorough beyond revoking it.
• Your organisation rotates on a schedule.
• An attribute certificate is expiring — though tovio key renew is usually what you want instead.

It is crash-resumable

An interrupted rotation leaves a marker and can be finished by simply running the command again. If re-running cannot recover the staged state — usually a locked keychain — you get TVO-KEY-004. Unlock the keychain and re-run; that fixes it in almost every case.

Rotation also writes a signed journal linking each key to its predecessor, anchored at the repository's genesis signing key. If that chain does not verify, TOVIO trusts no old key from it and fails closed with TVO-KEY-005. That is a deliberate defence against a planted journal coaxing a reader into loading an attacker's "old" key — it is not a corruption you should work around.

What it does not do

Rotation protects future reads, and re-seals HEAD. Anything already decrypted and copied is out of reach, and older commits stay sealed as they were. If a secret leaked, rotate the secret itself as well.

Back up the new key

tovio key export backup.key --passphrase-file pass.txt

Rotating and not re-exporting leaves your backup pointing at the old key.

Related

tovio key renew     # renew attribute certificatestovio key status    # what you hold and when it expires

Team-wide rotation

Revoking a recipient already re-seals HEAD to the reduced roster, so removing someone does this for the content they could read.