2017-11-14 11:13:11 +00:00
|
|
|
---
|
2020-01-18 00:18:09 +00:00
|
|
|
layout: docs
|
|
|
|
page_title: Vault Enterprise Seal Wrap
|
2017-11-14 11:13:11 +00:00
|
|
|
description: |-
|
|
|
|
Vault Enterprise features a mechanism to wrap values with an extra layer of
|
2022-05-17 20:28:20 +00:00
|
|
|
encryption for supporting seals.
|
2017-11-14 11:13:11 +00:00
|
|
|
---
|
|
|
|
|
2023-07-18 21:07:55 +00:00
|
|
|
# Seal wrap
|
2017-11-14 11:13:11 +00:00
|
|
|
|
2023-07-27 17:42:39 +00:00
|
|
|
@include 'alerts/enterprise-and-hcp.mdx'
|
2020-01-25 00:18:22 +00:00
|
|
|
|
2017-11-14 11:13:11 +00:00
|
|
|
Vault Enterprise features a mechanism to wrap values with an extra layer of
|
2023-01-26 00:12:15 +00:00
|
|
|
encryption for supporting [seals](/vault/docs/configuration/seal). This adds an
|
2017-11-14 11:13:11 +00:00
|
|
|
extra layer of protection and is useful in some compliance and regulatory
|
|
|
|
environments, including FIPS 140-2 environments.
|
|
|
|
|
|
|
|
To use this feature, you must have an active or trial license for Vault
|
2021-09-29 14:17:31 +00:00
|
|
|
Enterprise Plus (HSMs). To start a trial, contact [HashiCorp
|
2017-11-14 11:13:11 +00:00
|
|
|
sales](mailto:sales@hashicorp.com).
|
|
|
|
|
2018-02-12 20:20:07 +00:00
|
|
|
## Enabling/Disabling
|
|
|
|
|
2018-02-12 20:28:06 +00:00
|
|
|
Seal Wrap is enabled by default on supporting seals. This implies that the seal
|
|
|
|
must be available throughout Vault's runtime. Most cloud-based seals should be
|
|
|
|
quite reliable, but, for instance, if using an HSM in a non-HA setup a
|
|
|
|
connection interruption to the HSM will result in issues with Vault
|
2018-02-12 20:20:07 +00:00
|
|
|
functionality.
|
|
|
|
|
|
|
|
To disable seal wrapping, set `disable_sealwrap = true` in Vault's
|
2018-02-12 20:28:06 +00:00
|
|
|
[configuration file][configuration]. This will not affect auto-unsealing functionality; Vault's
|
2022-03-17 05:01:38 +00:00
|
|
|
root key will still be protected by the seal wrapping mechanism. It will
|
2018-02-12 20:20:07 +00:00
|
|
|
simply prevent other storage entries within Vault from being seal wrapped.
|
|
|
|
|
2020-01-18 00:18:09 +00:00
|
|
|
_N.B._: This is a lazy downgrade; as keys are accessed or written their seal
|
2018-02-12 20:20:07 +00:00
|
|
|
wrapping status will change. Similarly, if the flag is removed, it will be a
|
2018-02-12 20:28:06 +00:00
|
|
|
lazy upgrade (which is the case when initially upgrading to a seal
|
|
|
|
wrap-supporting version of Vault).
|
2018-02-12 20:20:07 +00:00
|
|
|
|
2023-07-18 21:07:55 +00:00
|
|
|
## Activating seal wrapping
|
2017-11-14 11:13:11 +00:00
|
|
|
|
|
|
|
For some values, seal wrapping is always enabled with a supporting seal. This
|
2022-03-17 05:01:38 +00:00
|
|
|
includes the recovery key, any stored key shares, the root key, the keyring,
|
2017-11-14 11:13:11 +00:00
|
|
|
and more; essentially, any Critical Security Parameter (CSP) within Vault's
|
|
|
|
core. If upgrading from a version of Vault that did not support seal wrapping,
|
|
|
|
the next time these values are read they will be seal-wrapped and stored.
|
|
|
|
|
|
|
|
Backend mounts within Vault can also take advantage of seal wrapping. Seal
|
|
|
|
wrapping can be activated at mount time for a given mount by mounting the
|
|
|
|
backend with the `seal_wrap` configuration value set to `true`. (This value
|
|
|
|
cannot currently be changed later.)
|
|
|
|
|
|
|
|
A given backend's author can specify which values should be seal-wrapped by
|
2022-01-27 21:30:55 +00:00
|
|
|
identifying where CSPs are stored. They may also choose to seal wrap all or none
|
|
|
|
of their values.
|
2017-11-14 11:13:11 +00:00
|
|
|
|
|
|
|
Note that it is often an order of magnitude or two slower to write to and read
|
|
|
|
from HSMs or remote seals. However, values will be cached in memory
|
|
|
|
un-seal-wrapped (but still encrypted by Vault's built-in cryptographic barrier)
|
|
|
|
in Vault, which will mitigate this for read-heavy workloads.
|
|
|
|
|
2023-07-18 21:07:55 +00:00
|
|
|
## Seal wrap and replication
|
2017-11-14 11:13:11 +00:00
|
|
|
|
|
|
|
Seal wrapping takes place below the replication logic. As a result, it is
|
|
|
|
transparent to replication. Replication will convey which values should be
|
|
|
|
seal-wrapped, but it is up to the seal on the local cluster to implement it.
|
|
|
|
In practice, this means that seal wrapping can be used without needing to have
|
|
|
|
the replicated keys on both ends of the connection; each cluster can have
|
|
|
|
distinct keys in an HSM or in KMS.
|
|
|
|
|
|
|
|
In addition, it is possible to replicate from a Shamir-protected primary
|
|
|
|
cluster to clusters that use HSMs when seal wrapping is required in downstream
|
|
|
|
datacenters but not in the primary.
|
|
|
|
|
2023-07-18 21:07:55 +00:00
|
|
|
## Wrapped parameters
|
2022-08-01 14:32:47 +00:00
|
|
|
|
|
|
|
Each plugin (whether secret or auth) maintains control over parameters it
|
|
|
|
feels are best to Seal Wrap. These are usually just a few core values as
|
|
|
|
Seal Wrapping does incur some performance overhead.
|
|
|
|
|
|
|
|
Some examples of places where seal wrapping is used include:
|
|
|
|
|
2023-01-26 00:12:15 +00:00
|
|
|
- The [LDAP](/vault/docs/auth/ldap), [RADIUS](/vault/docs/auth/radius),
|
|
|
|
[Okta](/vault/docs/auth/okta), and [AWS](/vault/docs/auth/aws) auth methods,
|
2022-08-01 14:32:47 +00:00
|
|
|
for storing their config.
|
2023-01-26 00:12:15 +00:00
|
|
|
- [PKI](/vault/docs/secrets/pki) for storing the issuers and their keys,
|
|
|
|
- [SSH](/vault/docs/secrets/ssh) for storing the CA's keys,
|
|
|
|
- [KMIP](/vault/docs/secrets/kmip) for storing managed objects (externally-provided
|
2022-08-01 14:32:47 +00:00
|
|
|
keys) and its CA keys.
|
2023-01-26 00:12:15 +00:00
|
|
|
- [Transit](/vault/docs/secrets/transit) for storing keys and their policy.
|
2022-08-01 14:32:47 +00:00
|
|
|
|
2023-07-18 21:07:55 +00:00
|
|
|
## FIPS status
|
2022-05-17 20:28:20 +00:00
|
|
|
|
2023-01-26 00:12:15 +00:00
|
|
|
See the [FIPS-specific Seal Wrap documentation](/vault/docs/enterprise/fips/sealwrap)
|
2022-05-17 20:28:20 +00:00
|
|
|
for more information about using Seal Wrapping to achieve FIPS 140-2 compliance.
|
2023-01-26 00:12:15 +00:00
|
|
|
Note that there are additional [FIPS considerations](/vault/docs/enterprise/sealwrap#seal-wrap-and-replication)
|
2022-05-17 20:28:20 +00:00
|
|
|
regarding Seal Wrap usage and Vault Replication.
|
2018-02-12 20:28:06 +00:00
|
|
|
|
2023-01-26 00:12:15 +00:00
|
|
|
[configuration]: /vault/docs/configuration
|