My question really is: how does an enterprise (a small ~150-employee company) manage the passphrases and encryption keys used at the time of encrypting a large volume of data, when such encrypted data is supposed to be in "cold storage", and available, for decades?

But this "underlying" question is perhaps too open-ended for this site, so I hope that answers to my "official" question in the title will point in the right direction.

The scenario alluded to above presents a serious conflict between the common practice of changing passphrases frequently, and the fact that the encrypted data is voluminous enough that could not be re-encrypted using a different key without a great deal of effort.

1 Answer 1


I think you might want to consider GPG & it's keys, and possibly keyservers too if they might be useful.

  • It's the only encryption software I can think of now that's already been working well for decades, and will probably be around in future decades
  • Can have multiple recipients (users) able to decrypt something, or possibly only encrypt a "master key" for an archive, then encrypt the master key file for multiple users, and add or change users without needing to re-encrypt the entire archive (the master key stays the same, similar to the LUKS master key & passphrases model)
  • You can change a secret key's passphrase without needing to create a whole new secret key

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.