HashiCorp Vault

hashicorp vault is an identity based secrets and encryption management system that provides encryption services that are gated by authentication and authorization methods a secret is anything that you want to tightly control access to, such as api encryption keys, passwords, and certificates integration benefits vault enterprise integrates with hsm platforms to provide the following special functionality master key wrapping vault protects its master key by transiting it through the hsm for encryption rather than splitting it into key shares automatic unsealing vault stores its encrypted master key in storage, enabling automatic unsealing seal wrapping provides fips keystorage conforming functionality for critical security parameters entropy augmentation enables vault to leverage the {{ch}} for augmenting system entropy master key wrapping and automatic unsealing some large organizations use complex processes to designate key officers who must be available to unseal vault installations because the most common pattern is to deploy vault immutably as such, automating unseal by using an hsm provides a simplified yet secure way of unsealing vault nodes when you deploy them vault pulls its encrypted master key from storage and transits it through the hsm for decryption through pkcs #11 api after it decrypts the master key, vault uses the master key to decrypt the encryption key to resume vault operations seal wrapping vault encrypts secrets using 256 bit aes in gcm mode with a randomly generated nonce before writing them to its persistent storage by enabling seal wrap, vault wraps your secrets with an extra layer of encryption, leveraging the hsm encryption and decryption benefits of the seal wrap seal wrap functionality provides the following benefits conform with fips 140 2 directives on key storage and key transport as certified by leidos support the fips level of security to be equal to hsm for example, if you use level 3 hardware encryption on an hsm, vault uses fips 140 2 level 3 cryptography enable you to deploy vault in high security grc environments, such as pci dss and hipaa, where fips guidelines are important for external audits provide a pathway to use vault to manage department of defense or nato military secrets offer entropy augmentation that allows vault to leverage the hsm to augment system entropy with entropy augmentation enabled, the following keys and tokens leverage the configured external entropy source master key aes key that is encrypted by the seal mechanism this encrypts the key ring key ring encryption keys the keys that encrypt all of vault's storage embedded in the vault keyring recovery key with auto unseal, use the recovery keys to regenerate the root token, key rotation, and so on tls private keys for ha leader, raft, and enterprise replications mfa totp keys the keys used for totp in vault enterprise mfa jwt signing keys the keys used to sign wrapping token jwts root tokens superuser tokens granting access to all operations in vault dr operation tokens token that allows certain actions to be performed on a dr secondary the transit secrets engine manages several key types and leverages the keysutil package to generate keys it uses the external entropy source for key generation