noqtis-rotate(1)

NAME

noqtis-rotate — say that a seal key was replaced by a new one

SYNOPSIS

noqtis rotate -k key [-p key.pub] -n new [--new-pub new.pub] [--at time] [--reason text] [-o file] [-f]

DESCRIPTION

noqtis rotate writes a key statement (‘noqtis-keys-1, noqtis-capsule(5)’) that the signing key key was replaced by new from time. Both keys sign it: the old one to say so, the new one to show that its holder has it. Give the statement to those who check your capsules: noqtis-check(1) -p key.pub --keys file then accepts capsules sealed with new, and capsules sealed with key only when a verified timestamp shows they were sealed before time. Rotate again from new to go on; the chain is followed up to 32 rotations.

Each signature is checked before the statement is written. Both keys must be post-quantum signature keys (ML-DSA, SLH-DSA or a hybrid), of the same or of different algorithms.

-k key, --key=key: The secret key being replaced.
-p key.pub, --pub=key.pub: Its public key. Default: key.pub.
-n new, --new=new: The secret key that replaces it.
--new-pub new.pub: Its public key. Default: new.pub.
--at time: When the replacement takes effect, as ‘YYYY-MM-DDTHH:MM:SSZ’ (UTC, 1970 or later). Default: now.
--reason text: Up to 255 bytes of text, kept in the statement.
-o file, --out=file: Write the statement to file instead of standard output.
-f, --force: Replace file if it exists.

EXIT STATUS

0: The statement was written.
2: A usage error, a key file that cannot be read, keys that are not a pair or not post-quantum, the new key equal to the old one, or a file that cannot be written.

EXAMPLES

$ noqtis keygen -a ML-DSA-65 -o me2
$ noqtis rotate -k me -n me2 --reason "new laptop" -o me-me2.keys
$ noqtis seal -k me2 results
$ noqtis check -p me.pub --keys me-me2.keys results