f6ac1be13a
* Begin restructuring FIPS documentation This creates a new FIPS category under Enterprise and copies the FIPS-specific seal wrap documentation into it. We leave the existing Seal Wrap page at the old path, but document that the FIPS-specific portions of it have moved. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add initial FIPS 140-2 inside documentation This documents the new FIPS 140-2 Inside binary and how to use and validate it. This also documents which algorithms are certified for use in the BoringCrypto distribution. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add notes about FIPS algorithm restrictions Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com>
119 lines
2.5 KiB
Plaintext
119 lines
2.5 KiB
Plaintext
---
|
||
layout: api
|
||
page_title: /sys/tools - HTTP API
|
||
description: This is the API documentation for a general set of crypto tools.
|
||
---
|
||
|
||
# `/sys/tools`
|
||
|
||
The `/sys/tools` endpoints are a general set of tools.
|
||
|
||
## Generate Random Bytes
|
||
|
||
This endpoint returns high-quality random bytes of the specified length.
|
||
|
||
| Method | Path |
|
||
| :----- | :------------------------------------- |
|
||
| `POST` | `/sys/tools/random(/:source)(/:bytes)` |
|
||
|
||
### Parameters
|
||
|
||
- `bytes` `(int: 32)` – Specifies the number of bytes to return. This value can
|
||
be specified either in the request body, or as a part of the URL.
|
||
|
||
- `format` `(string: "base64")` – Specifies the output encoding. Valid options
|
||
are `hex` or `base64`.
|
||
|
||
- `source` `(string: "platform")` - Specifies the source of the requested bytes.
|
||
`platform`, the default, sources bytes from the platform's entropy source.
|
||
`seal` sources from entropy augmentation (enterprise only).
|
||
`all` mixes bytes from all available sources.
|
||
|
||
### Sample Payload
|
||
|
||
```json
|
||
{
|
||
"format": "hex"
|
||
}
|
||
```
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request POST \
|
||
--data @payload.json \
|
||
http://127.0.0.1:8200/v1/sys/tools/random/164
|
||
```
|
||
|
||
### Sample Response
|
||
|
||
```json
|
||
{
|
||
"data": {
|
||
"random_bytes": "dGhlIHF1aWNrIGJyb3duIGZveAo="
|
||
}
|
||
}
|
||
```
|
||
|
||
## Hash Data
|
||
|
||
This endpoint returns the cryptographic hash of given data using the specified
|
||
algorithm.
|
||
|
||
| Method | Path |
|
||
| :----- | :----------------------------- |
|
||
| `POST` | `/sys/tools/hash(/:algorithm)` |
|
||
|
||
### Parameters
|
||
|
||
- `algorithm` `(string: "sha2-256")` – Specifies the hash algorithm to use. This
|
||
can also be specified as part of the URL. Currently-supported algorithms are:
|
||
|
||
- `sha2-224`
|
||
- `sha2-256`
|
||
- `sha2-384`
|
||
- `sha2-512`
|
||
- `sha3-224`
|
||
- `sha3-256`
|
||
- `sha3-384`
|
||
- `sha3-512`
|
||
|
||
~> **Note**: In FIPS 140-2 mode, the following algorithms are not certified
|
||
and thus should not be used: `sha3-224`, `sha3-256`, `sha3-384`, and
|
||
`sha3-512`.
|
||
|
||
- `input` `(string: <required>)` – Specifies the **base64 encoded** input data.
|
||
|
||
- `format` `(string: "hex")` – Specifies the output encoding. This can be either
|
||
`hex` or `base64`.
|
||
|
||
### Sample Payload
|
||
|
||
```json
|
||
{
|
||
"input": "adba32=="
|
||
}
|
||
```
|
||
|
||
### Sample Request
|
||
|
||
```shell-session
|
||
$ curl \
|
||
--header "X-Vault-Token: ..." \
|
||
--request POST \
|
||
--data @payload.json \
|
||
http://127.0.0.1:8200/v1/sys/tools/hash/sha2-512
|
||
```
|
||
|
||
### Sample Response
|
||
|
||
```json
|
||
{
|
||
"data": {
|
||
"sum": "dGhlIHF1aWNrIGJyb3duIGZveAo="
|
||
}
|
||
}
|
||
```
|