Re: cgd questions

[Greg Troxel <gdt%lexort.com@localhost>]

Thomas Klausner <wiz%NetBSD.org@localhost> writes:

> IIUC the cgdconfig man page correctly, this is how you do that:
>
>      To create a new parameters file that will generate the same key as an old
>      parameters file:
>
>              # cgdconfig -G -o newparamsfile oldparamsfile
>              old file's passphrase:
>              new file's passphrase:

I think what that does is encrypt the old key using the new passphrase,
and store that encrypted key in the config file.  Thus you haven't
changed the key, but you have a config file that allows decryption with
a new passphrase.  That's good to give a second person access, but it
doesn't revoke the first passphrase's access, if I understood correctly.