# Rotate derived SSH/GPG keys

**URL:** <https://onlykey.discourse.group/t/rotate-derived-ssh-gpg-keys/527>\
**Category:** SSH, OpenPGP, GPG\
**Created:** [October 11, 2021, 11:45am UTC](https://onlykey.discourse.group/t/rotate-derived-ssh-gpg-keys/527 "2021-10-11T11:45:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://onlykey.discourse.group/u/Ian)\
**Post date:** [October 11, 2021, 11:45am UTC](https://onlykey.discourse.group/t/rotate-derived-ssh-gpg-keys/527/1 "2021-10-11T11:45:52Z")

</div>

Hi,

Am I right in thinking that if I later wish to rotate SSH/GPG **derived** keys I’ve used from my OnlyKey I have to completely reset it? From what I understand the random key from which the SSH/GPG keys are derived is generated once at setup and cannot be altered afterward?

Thanks

---

<div class="post-metadata">

**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\
**Post date:** [October 11, 2021, 5:09pm UTC](https://onlykey.discourse.group/t/rotate-derived-ssh-gpg-keys/527/2 "2021-10-11T17:09:22Z")

</div>

No you would not need to reset device. You could either use a different email to generate a different key or if you must keep the same email you could use a different timestamp which will also generate a different key like this - [OnlyKey SSH/GPG agent | Docs](https://docs.crp.to/onlykey-agent.html#how-do-i-create-a-different-derived-private-key-using-same-identity)

If you want more control over keys you could also use stored keys - [OnlyKey SSH/GPG agent | Docs](https://docs.crp.to/onlykey-agent.html#gpg-agent-quickstart-guide-stored-keys)

---

<div class="post-metadata">

**Author:** ![Ian](https://avatars.discourse-cdn.com/v4/letter/i/bb73d2/32.png) [@Ian](https://onlykey.discourse.group/u/Ian)\
**Post date:** [October 11, 2021, 8:02pm UTC](https://onlykey.discourse.group/t/rotate-derived-ssh-gpg-keys/527/3 "2021-10-11T20:02:34Z")

</div>

Thanks - does using different timestamps apply to GPG only though? I could not see an option to specify timestamp with `onlykey-agent` for SSH.

---

<div class="post-metadata">

**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\
**Post date:** [October 12, 2021, 11:10am UTC](https://onlykey.discourse.group/t/rotate-derived-ssh-gpg-keys/527/4 "2021-10-12T11:10:07Z")

</div>

Yes, for ssh you could just pass whatever identity you want to use like this:

```auto
$ onlykey-agent identity -- ssh user@server

```