How to re-encrypt .password-store using new gpg key

Question

I am using pass to manage my passwords. It uses my GPG key to encrypt.

My key recently expired and I created a new one.

pass will no longer create new passwords since my old key expired.

I can decrypt existing passwords. It uses the old ID 3D1B47D3 as when decrypting I see gpg: Note: secret key 3D1B47D3 expired at Sun 02 Jul 2017 16:36:45 BST.

3D1B47D3 is my old key id, 1F7CCC88 is my new key ID.

Therefore I need to re-encrypt ~/.password-store using my new key. The docs say using pass init 1F7CCC88 should do so.

However I get the error:

gpg: [stdin]: encryption failed: Unusable public key
gpg: Note: secret key 3D1B47D3 expired at Sun 02 Jul 2017 16:36:45 BST`. 

The error is repeated for every password.

~/.password-store/.gpg-id contains my new key ID since running init.

I can encrypt files manually using gpg --encrypt filename using my new key.

Note my keys and sub-keys all have an expire date in the future.

pub   4096R/1F7CCC88 2016-07-02 [expires: 2018-07-28]
uid                  Kris Leech <kris.leech@gmail.com>
sub   4096R/3D1B47D3 2016-07-02 [expires: 2018-07-28]
sub   2048R/E77481E9 2016-07-28 [expires: 2018-07-28]

Answer 1

Looks like pass is using gpg2, you created the keys using gpg, and there is something not supported in gpg2 (md5 deprecated?).

e.g. decrypting with gpg works:

$ gpg -d --quiet secret.gpg 

You need a passphrase to unlock the secret key for
user: "bot three (third bot) <bot3@blah.com>"
2048-bit RSA key, ID 2A8EA0F6, created 2017-08-24 (main key ID 2003591B)

something much longer then blah

and with gpg2 doesn't:

$ gpg2 -d --quiet secret.gpg 
gpg: decryption failed: No secret key

Renaming gpg2 forces pass to use gpg:

# mv /usr/bin/gpg2 /usr/bin/gpg2-css
$ pass show test/secret
something much longer then blah

What you can do is:

1. Rename gpg2.
2. Create a gpg2 key.
3. Re-init the password store using the new gpg2 generated key to re-encrypt.
4. Rename gpg2 back to gpg2.

Should work again at this point. From here, use gpg2, not gpg.

hth.

Answer 2

In addition to the answer I accepted I wanted to post another option. You can just import your existing key in to gpg2.

gpg --list-keys
gpg --export [ID] > public.key
gpg --export-secret-key [ID] > private.key
gpg2 --import public.key
gpg2 --import private.key
rm public.key private.key

Answer 3

I'm late to the party but I found a solution.

I must say that none of this solutions worked for me and I have multiple folders inside ~/.password-store with dozens of keys which means i can't avoid the folder issue.

What worked for me is:

$ cp -r ~/.password-store ~/.password-store.backup
$ cd ~/.password-store
$ pass init <new-gpg-key-hash>
Password store initialized for <new-gpg-key-hash>
folder1/pass1: reencrypting to <new-gpg-key-hash> 
gpg: Note: secret key <old-gpg-key-hash> expired at Tue XX Jul 2021 XX:YY:ZZ AM EDT
folder2/pass1: reencrypting to <new-gpg-key-hash> 
gpg: Note: secret key <old-gpg-key-hash> expired at Tue XX Jul 2021 XX:YY:ZZ AM EDT
...

You can verify it worked by copying a pass and generating a new pass (causing the can't verify authenticity of some other public key which turns out was strange side effect):

pass -c folder1/pass1
pass generate test/test

This did work. If something is wrong you can simply:

mv ~/.password-store.backup ~/.password-store

Hope it helps someone else! cheers