{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
        "slug": "do-not-treat-a-borg-passphrase-change-as-repository-key-rotation",
        "url": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/"
        },
        "title": "Do not treat a Borg passphrase change as repository-key rotation",
        "summary": "Distinguish a changed Borg passphrase from replacement of compromised repository secrets.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:02+00:00",
        "modified_at": "2026-10-15T13:36:16+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 244,
        "potentially_affected": "This applies to Borg 1.4.5 encrypted-key administration. It distinguishes wrapper-passphrase changes from compromised repository secrets, rather than providing a complete incident-response or data-migration procedure.",
        "dse_recommendation": "DSE recommends recording what was exposed before choosing the recovery action: a passphrase, an encrypted key file, or usable repository secrets together.",
        "primary_source": {
            "name": "Borg 1.4.5 — Key Management",
            "url": "https://borgbackup.readthedocs.io/en/stable/usage/key.html",
            "published_on": null,
            "authority": "borgbackup.readthedocs.io"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Distinguish a changed Borg passphrase from replacement of compromised repository secrets.</p>\n<h2>Source facts</h2>\n<p>Borg 1.4.5 key change-passphrase changes protection of the stored key, not the underlying encryption or authentication secrets or chunker seed. If an attacker already obtained both key and passphrase, changing only that passphrase does not protect past or future backups in the same repository. The key-export procedure also leaves the exported key encrypted and does not include its passphrase; regaining access requires both. Passphrase management and repository-secret compromise are therefore different operational cases.</p>\n<p>Source: <a href=\"https://borgbackup.readthedocs.io/en/stable/usage/key.html\">Borg 1.4.5 — Key Management</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to Borg 1.4.5 encrypted-key administration. It distinguishes wrapper-passphrase changes from compromised repository secrets, rather than providing a complete incident-response or data-migration procedure.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends recording what was exposed before choosing the recovery action: a passphrase, an encrypted key file, or usable repository secrets together. Escalate confirmed secret compromise for a reviewed replacement-repository and recovery plan rather than closing the issue after a password prompt succeeds. Keep exported key custody and passphrase custody deliberate and independently recoverable. Document the scope of any exposure assessment, including historical backups, without claiming a new passphrase has retroactively secured already compromised material.</p>\n<h2>Verification</h2>\n<p>In a disposable repository, change the passphrase and verify the documented key-handling and recovery procedure with authorized operators. Confirm the incident worksheet distinguishes passphrase replacement from repository-secret replacement. Retain only nonsecret identifiers and test outcomes; never place real keys or passphrases in the public evidence record.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://borgbackup.readthedocs.io/en/stable/usage/key.html\">Borg 1.4.5 — Key Management</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Distinguish a changed Borg passphrase from replacement of compromised repository secrets.\nSource facts\nBorg 1.4.5 key change-passphrase changes protection of the stored key, not the underlying encryption or authentication secrets or chunker seed. If an attacker already obtained both key and passphrase, changing only that passphrase does not protect past or future backups in the same repository. The key-export procedure also leaves the exported key encrypted and does not include its passphrase; regaining access requires both. Passphrase management and repository-secret compromise are therefore different operational cases.\nSource: Borg 1.4.5 — Key Management.\nApplicability\nThis applies to Borg 1.4.5 encrypted-key administration. It distinguishes wrapper-passphrase changes from compromised repository secrets, rather than providing a complete incident-response or data-migration procedure.\nDSE recommendation\nDSE recommends recording what was exposed before choosing the recovery action: a passphrase, an encrypted key file, or usable repository secrets together. Escalate confirmed secret compromise for a reviewed replacement-repository and recovery plan rather than closing the issue after a password prompt succeeds. Keep exported key custody and passphrase custody deliberate and independently recoverable. Document the scope of any exposure assessment, including historical backups, without claiming a new passphrase has retroactively secured already compromised material.\nVerification\nIn a disposable repository, change the passphrase and verify the documented key-handling and recovery procedure with authorized operators. Confirm the incident worksheet distinguishes passphrase replacement from repository-secret replacement. Retain only nonsecret identifiers and test outcomes; never place real keys or passphrases in the public evidence record.\nOfficial reference\nBorg 1.4.5 — Key Management. Reviewed October 15, 2026.",
        "content_markdown": "Distinguish a changed Borg passphrase from replacement of compromised repository secrets.\n\n## Source facts\n\nBorg 1.4.5 key change-passphrase changes protection of the stored key, not the underlying encryption or authentication secrets or chunker seed. If an attacker already obtained both key and passphrase, changing only that passphrase does not protect past or future backups in the same repository. The key-export procedure also leaves the exported key encrypted and does not include its passphrase; regaining access requires both. Passphrase management and repository-secret compromise are therefore different operational cases.\n\nSource: [Borg 1.4.5 — Key Management](https://borgbackup.readthedocs.io/en/stable/usage/key.html).\n\n## Applicability\n\nThis applies to Borg 1.4.5 encrypted-key administration. It distinguishes wrapper-passphrase changes from compromised repository secrets, rather than providing a complete incident-response or data-migration procedure.\n\n## DSE recommendation\n\nDSE recommends recording what was exposed before choosing the recovery action: a passphrase, an encrypted key file, or usable repository secrets together. Escalate confirmed secret compromise for a reviewed replacement-repository and recovery plan rather than closing the issue after a password prompt succeeds. Keep exported key custody and passphrase custody deliberate and independently recoverable. Document the scope of any exposure assessment, including historical backups, without claiming a new passphrase has retroactively secured already compromised material.\n\n## Verification\n\nIn a disposable repository, change the passphrase and verify the documented key-handling and recovery procedure with authorized operators. Confirm the incident worksheet distinguishes passphrase replacement from repository-secret replacement. Retain only nonsecret identifiers and test outcomes; never place real keys or passphrases in the public evidence record.\n\n## Official reference\n\n[Borg 1.4.5 — Key Management](https://borgbackup.readthedocs.io/en/stable/usage/key.html). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
                "url": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Do not treat a Borg passphrase change as repository-key rotation",
                        "item": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/#article",
                "identifier": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
                "url": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/",
                "headline": "Do not treat a Borg passphrase change as repository-key rotation",
                "description": "Distinguish a changed Borg passphrase from replacement of compromised repository secrets.",
                "abstract": "Distinguish a changed Borg passphrase from replacement of compromised repository secrets.",
                "articleBody": "Distinguish a changed Borg passphrase from replacement of compromised repository secrets.\nSource facts\nBorg 1.4.5 key change-passphrase changes protection of the stored key, not the underlying encryption or authentication secrets or chunker seed. If an attacker already obtained both key and passphrase, changing only that passphrase does not protect past or future backups in the same repository. The key-export procedure also leaves the exported key encrypted and does not include its passphrase; regaining access requires both. Passphrase management and repository-secret compromise are therefore different operational cases.\nSource: Borg 1.4.5 — Key Management.\nApplicability\nThis applies to Borg 1.4.5 encrypted-key administration. It distinguishes wrapper-passphrase changes from compromised repository secrets, rather than providing a complete incident-response or data-migration procedure.\nDSE recommendation\nDSE recommends recording what was exposed before choosing the recovery action: a passphrase, an encrypted key file, or usable repository secrets together. Escalate confirmed secret compromise for a reviewed replacement-repository and recovery plan rather than closing the issue after a password prompt succeeds. Keep exported key custody and passphrase custody deliberate and independently recoverable. Document the scope of any exposure assessment, including historical backups, without claiming a new passphrase has retroactively secured already compromised material.\nVerification\nIn a disposable repository, change the passphrase and verify the documented key-handling and recovery procedure with authorized operators. Confirm the incident worksheet distinguishes passphrase replacement from repository-secret replacement. Retain only nonsecret identifiers and test outcomes; never place real keys or passphrases in the public evidence record.\nOfficial reference\nBorg 1.4.5 — Key Management. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:02+00:00",
                "dateModified": "2026-10-15T13:36:16+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/do-not-treat-a-borg-passphrase-change-as-repository-key-rotation/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Do not treat a Borg passphrase change as repository-key rotation"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 244,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Borg 1.4.5 — Key Management",
                    "url": "https://borgbackup.readthedocs.io/en/stable/usage/key.html"
                }
            }
        ]
    }
}