Is there any interest in supporting a kind of password/key rotation for the crypt remote?
Motivating use cases:
Sharing with a group; group member leaves
Incremental re-encryption in case of compromise
The basic idea is that a single crypt remote could have multiple passwords, organized in a linear sequence. The newest password would always be used for newly created files, but older files could continue to be accessed with older passwords until the relevant password is retired.
I'm happy to flesh out the idea more, if there's any interest in the community.
It's not quite the same but you can accomplish this manually with Union and multiple crypt remotes.
Personally, I do not think of crypt passwords as passwords (despite the name) and instead as keys (since they are used to derive it). The "password" I keep is the encrypted config password. So when I want to rotate my password, I just change that.
I am not an expert in how other systems work but I think it is similar. You use a password to encrypt a key and then you use the key to do encryption. To change the password, you just change the key's password.
I agree that "key" makes more sense than "password". Just using the term used in the docs.
I did not know about Union. I think that will work for me. Thanks.
For the systems I'm interested in building, it's important to rotate the actual underlying encryption key, because that's shared with a group. And if you want to stop sharing with a person you need to start using a new key (and then only share the new key with the other group members).