# kosa8 key

Manage the keys that encrypt snapshots at rest and in transit

Each encrypted snapshot has its own data key, stored only wrapped under a
key-encryption key (KEK). The KEK is held by a provider: today a file in
~/.kosa8/keys, protected by its permissions and by FileVault or LUKS
(KOSA8_KEY_PROVIDER=file). Keychain, TPM, PKCS#11 and cloud KMS
providers are planned behind the same interface.

See docs/design/encryption-at-rest.md.

## Subcommands

- [`kosa8 key export`](https://docs.kosa8.com/reference/key-export.md): Write the active KEK to a file, to import on another machine
- [`kosa8 key import`](https://docs.kosa8.com/reference/key-import.md): Add a KEK exported from another machine and make it active
- [`kosa8 key rotate`](https://docs.kosa8.com/reference/key-rotate.md): Rewrap every snapshot key under a new KEK and destroy the old one
- [`kosa8 key status`](https://docs.kosa8.com/reference/key-status.md): Show the key provider, the KEKs held, and how many snapshot keys they wrap

---
Source: https://docs.kosa8.com/reference/key/