Do not treat a Borg passphrase change as repository-key rotation

Distinguish a changed Borg passphrase from replacement of compromised repository secrets.

Source facts

Borg 1.4.5 key change-passphrase changes protection of the stored key, not the underlying encryption or authentication secrets or chunker seed. If an attacker already obtained both key and passphrase, changing only that passphrase does not protect past or future backups in the same repository. The key-export procedure also leaves the exported key encrypted and does not include its passphrase; regaining access requires both. Passphrase management and repository-secret compromise are therefore different operational cases.

Source: Borg 1.4.5 — Key Management.

Applicability

This applies to Borg 1.4.5 encrypted-key administration. It distinguishes wrapper-passphrase changes from compromised repository secrets, rather than providing a complete incident-response or data-migration procedure.

DSE recommendation

DSE recommends recording what was exposed before choosing the recovery action: a passphrase, an encrypted key file, or usable repository secrets together. Escalate confirmed secret compromise for a reviewed replacement-repository and recovery plan rather than closing the issue after a password prompt succeeds. Keep exported key custody and passphrase custody deliberate and independently recoverable. Document the scope of any exposure assessment, including historical backups, without claiming a new passphrase has retroactively secured already compromised material.

Verification

In a disposable repository, change the passphrase and verify the documented key-handling and recovery procedure with authorized operators. Confirm the incident worksheet distinguishes passphrase replacement from repository-secret replacement. Retain only nonsecret identifiers and test outcomes; never place real keys or passphrases in the public evidence record.

Official reference

Borg 1.4.5 — Key Management. Reviewed October 15, 2026.