Automatic Unseal, Seal Wrap, and Entropy Augmentation
This document provides information about configuring the KMES Series 3 with HashiCorp Vault by using PKCS #11 libraries. If you have other questions about your KMES Series 3 device, see the relevant administrator guide.
Vault Enterprise integrates with Hardware Security Module (HSM) platforms (such as the KMES Series 3) to provide the following special functionality:
- Master Key Wrapping: Vault protects its master key by transiting it through the HSM for encryption rather than splitting it into key shares.
- Automatic Unsealing: Vault stores its encrypted master key in storage, allowing for automatic unsealing.
- Seal Wrapping: Seal wrapping provides FIPS KeyStorage-conforming functionality for Critical Security Parameters.
- Entropy Augmentation: Enables Vault to leverage the HSM for augmenting system entropy.
In some large organizations, designating key officers who must be available to unseal Vault installations can be complex because the most common pattern is to deploy Vault immutably. Thus, automating unseal by using an HSM provides a simplified yet secure way of unsealing Vault nodes as you deploy them.
Vault pulls its encrypted master key from storage and transits it through the HSM for decryption by using the PKCS #11 API. After it decrypts the master key, Vault uses the master key to decrypt the encryption key to resume Vault operations.
Vault encrypts secrets by using 256-bit AES in GCM mode with a randomly generated nonce before writing them to its persistent storage. When you enable Seal Wrap, Vault wraps your secrets with an extra layer of encryption, leveraging the HSM encryption and decryption.
Seal Wrap has the following benefits:
- Supports FIPS level of security equal to HSM.
- For example, if you use Level 3 hardware encryption on an HSM, Vault uses FIPS 140-2 Level 3 cryptography.
- Enables you to deploy Vault in high-security Governance, risk management, and compliance (GRC) environments (for example, PCI-DSS, HIPAA) where FIPS guidelines are important for external audits.
- Provides a pathway for using Vault in managing Department of Defense's (DOD) or North Atlantic Treaty Organization (NATO) military secrets.
Entropy Augmentation enables Vault to leverage the HSM for augmenting system entropy.
With Entropy Augmentation enabled, the following keys and tokens leverage the configured external entropy source.
Operation
Description
Master Key
The AES key encrypted by the seal mechanism. This key encrypts the key ring.
Key Ring Encryption Keys
The keys that encrypt all of the Vault storage are embedded in the Vault keyring.
Recovery Key
With auto-unseal, use the recovery keys to regenerate the root token, key rotation, and so on.
TLS Private Keys
For HA leader, Raft and Enterprise Replications.
MFA TOTP Keys
The keys used for time-based, one-time passwords (TOTP) in Vault Enterprise MFA.
JWT Signing Keys
The keys used to sign wrapping token JWTs.
Root Tokens
Superuser tokens granting access to all operations in Vault.
DR Operation Tokens
Token that allows certain actions to be performed on a Disaster Recovery (DR) secondary.
The transit-secrets engine manages several different key types and leverages the keysutil package to generate keys. It uses the external entropy source for key generation.
To use Automatic Unseal, Seal Wrap, and Entropy Augmentation, you must perform the following tasks:
- Install Futurex PKCS #11.
- Configure the KMES Series 3.
- Edit the PKCS #11 configuration file.
- Configure the PKCS #11 library with Vault.
The following sections describe how to perform these tasks.