Appendix: Rekeying and rotating Vault

if you install and configure hashicorp vault without hsm auto unseal , vault employs shamir's secret sharing algorithm https //en wikipedia org/wiki/shamir%27s secret sharing to prevent one person from having complete access to the system this process divides a secret into a subset of parts so that you need a subset of those parts to reconstruct the original secret vault makes heavy use of this algorithm as part of the unsealing process https //developer hashicorp com/vault/docs/concepts/seal when you initialize a vault server, vault generates a root key (previously known as master key) and splits this root key into a series of key shares following shamir's secret sharing algorithm the root key decrypts the underlying encryption key vault uses the encryption key to encrypt data at rest in a storage backend such as integrated storage https //developer hashicorp com/vault/tutorials/raft/raft storage distribute each of these key shares to trusted parties in the organization these parties must then come together to unseal the vault by entering their key share in some cases, such as the following ones, you might want to re generate the root key and its key shares someone joins or leaves the organization security wants to change the number of shares or threshold compliance mandates the keys be rotated at regular intervals in addition to rekeying the root key, you might need to rotate the underlying encryption key vault uses to encrypt data at rest in vault, rekeying and rotating are two separate operations rekeying is the process of generating a new root key and applying shamir's algorithm key rotation is the process of generating a new encryption key for vault when you deploy vault with hsm auto unseal , the initial vault server setup involves generating a root key on the kmes series 3 and a set of recovery keys with auto unseal, you create recovery keys instead of unseal keys rekeying vault to rekey the vault with hsm auto unseal configured, use the vault operator rekey command with the target=recovery flag this command generates a new set of recovery keys it does not generate a new root key on the kmes series 3 the process can optionally modify the total number of recovery key shares or the recovery key threshold required note that recovery keys cannot decrypt the root key; they are purely for authorization purposes run the following command to initialize the rekeying operation, modifying the key shares and key threshold values vault operator rekey target=recovery init key shares=3 key threshold=2 this command generates a nonce value and starts the rekeying process, as shown in the following example output all other unseal keys must also provide this nonce value this nonce value is not a secret, so it is safe to distribute over insecure channels like chat or email key value \ nonce 52bd8754 07f8 7ec9 811c 3bc23bbaee6b started true rekey progress 0/2 new shares 3 new threshold 2 verification required false each key holder runs the following command, specifying their unique recovery key in the last field instead of this example recovery key ( 8ijczkaqmfcih7kytqcyh7p/dpvfousensq/p5e1g9kx ) vault operator rekey target=recovery nonce="52bd8754 07f8 7ec9 811c 3bc23bbaee6b" 8ijczkaqmfcih7kytqcyh7p/dpvfousensq/p5e1g9kx example output key value \ nonce 52bd8754 07f8 7ec9 811c 3bc23bbaee6b started true rekey progress 1/2 new shares 3 new threshold 2 verification required false repeat the step to complete the rekey operation when the final unseal key holder enters their key, vault outputs the new recovery keys example output key 1 0e9tjzqoivqp7mk0nk0y564olyb3gbtqrobhsoq4h54b key 2 gqc6jevqoaslc5l9/z6erifuv6l6taorhzuxbj/6h3rp key 3 /hf1pbamfs0k3o3drvhkatfzxqflt6elow/nhear9g2g operation nonce 52bd8754 07f8 7ec9 811c 3bc23bbaee6b vault recovery keys rekeyed with 3 key shares and a key threshold of 2 please securely distribute the key shares printed above rotating the encryption key unlike rekeying the vault, rotating the vault encryption key does not require a quorum of recovery keys anyone with the proper permissions in vault can perform the encryption key rotation you can rotate keys automatically or manually with vault 1 7 and later, vault automatically rotates the backend encryption key before reaching 232 encryption operations, in adherence with nist sp800 32d guidelines adjust automatic key rotation run the following command to view the current automatic rotation policy vault read sys/rotate/config this returns the current status and configuration of automatic encryption key rotation, as shown in the following output example example output key value \ enabled true interval 0 max operations 3865470566 run the following command to configure a time interval for automatic key rotation vault write sys/rotate/config interval=2160h example output success! data written to sys/rotate/config run the following command to configure the maximum number of encryption operations per key vault write sys/rotate/config max operations=123456789 example output success! data written to sys/rotate/config perform manual key rotation run the following command to trigger a key rotation vault operator rotate example output the output displays the key version and installation time success! rotated key key term 2 install time 14 nov 23 21 47 utc encryption count 1 this adds a new key to the keyring this new key encrypts all new values written to the storage backend continuity of operations similar to the process with shamir's secret sharing, both rekeying and rotating operations with hsm auto unseal are fully online operations vault continues to service requests uninterrupted during these processes