Skip to content

Migrating to team folders and “Renew key” (F10)

Two procedures, both only with Krywerk clients (krywerk-hub, krywerk-mount, Krywerk app), against Krywerk Server and Cryptomator Hub (hub standard endpoints only: create vault, members, access grants, archive).

1. Boxcryptor folder → team folder

Like the migration from legacy to modern format (HANDOFF 7.5 C/D), except that the target is a team folder instead of a password vault:

  1. Create the target: HubSession::create_vault(ziel, name) (empty/new folder, the recovery key is shown once, F9) – or choose an existing team folder (unlocked via the server).
  2. Migration drive Overlay<Vault, CmVault>: Boxcryptor at the bottom (key file + password), the team folder on top (master key from the server, CmVault::open_with_masterkey). New and changed files end up in the team folder, “Migrate all” transfers the rest, “Finish migration” turns it into a pure team folder.
  3. Add members and grant access as with any team folder (before or after).

CLI: krywerk-mount <boxcryptor-folder> --keyfile K --upgrade-to <team-folder> recognizes from the hub header of vault.cryptomator that the target is a team folder and unlocks it via the server (browser sign-in) instead of with a password. If the target does not exist yet, --upgrade-to-team <server-url> --name <Name> creates it. --migrate-all works as before. App configuration: VaultConfig.upgradeTo + upgradeToHubId (team folder ID of the target).

2. “Renew key” (new master key, same members)

Purpose: after a person who poses a risk leaves (they know the old master key), the team folder gets a new master key. Format 8 has no key rotation, so: new vault, copy the content over, swap. Managers (OWNER) only. Communicate honestly: old copies (recycle bin/versions of the cloud storage, local copies of the person who left) remain readable with the old key.

Procedure (ordner = team folder, e.g. shared in OneDrive; working folders are placed next to it so that the sharing of the cloud folder is preserved):

  1. Check: OWNER, the folder is a team folder, not archived; fetch the old master key (own access).
  2. Write the journal ordner/../.<name>.krywerk-rekey.json (state, old/new vault ID, paths) – allows resuming after an interruption (--fortsetzen) or a clean rollback.
  3. Create a new team folder in ordner/../.<name>.krywerk-neu (create_vault, same name, same description; new recovery key → shown at the end).
  4. Carry over members: all direct members (people and groups) with their roles (set_member), except those excluded when calling (--ohne <who>, typically the person who left); then grant_pending for everyone with an account. Set up emergency access (F9) again if it was set up for the old folder (same threshold, same council without the excluded people; too few → notice, do not set up).
  5. Copy the content: kw_vault::copy::copy_tree(alt, neu), then compare_listing (names, types, sizes). Error → abort, the new vault is discarded (server: delete; local: delete the working folder), the old one stays unchanged.
  6. Swap (local, only renames within the same file system): a) move ordner/vault.cryptomator and ordner/d → ordner/../.<name>.krywerk-alt/, b) move neu/vault.cryptomator and neu/d → ordner/, remove the empty working folder neu. The journal records the intermediate state; an interruption between a) and b) is completed when resuming.
  7. Archive the old vault on the server (unlock → 410 for everyone who still has the old vault.cryptomator); access for the excluded people never existed in the new vault.
  8. Delete the old data …krywerk-alt (default) or keep it with --alte-behalten; delete the journal.

While this runs, the team folder must not be mounted anywhere (the CLI does not check the app's own mounts via the configuration – a notice to the user; the app unmounts it itself beforehand). Other members who have the folder open and write to it during copying lose those changes – so announce it beforehand (app and CLI ask for confirmation). Afterwards the cloud storage synchronizes the complete new content.

CLI: krywerk-hub schluessel-erneuern <ordner> [--ohne <who>…] [--alte-behalten] [--fortsetzen]. App: “Manage → Renew key …” with a confirmation prompt, progress, and display of the new recovery key.